CVE-2026-81178 Details

A vulnerability in SysReptor, a customizable pentest reporting platform, allows unauthenticated users with a public note share link to access project-wide collaborative editing metadata. This issue affects SysReptor versions prior to 2026.55. The vulnerability arises because public share consumers are added to the same collaboration group as authenticated project members, enabling them to receive client information and live editing events from notes that were not shared, although the content of those notes remains protected. The exposed metadata can identify project members through usernames and names, and includes identifiers and editing activity of unshared notes.

Users can update to SysReptor version 2026.55, which disables the transmission of client information and awareness events in shared note collaborative editing, preventing the leakage of project member identities and unshared note activity.