CVE-2026-81181

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor session cookie, place it in a victim's browser, and know the shared-note URL where the victim authenticates can reuse the fixed session after the victim enters the correct password and access that shared note. The main SysReptor login flow is not affected. This issue is fixed in version 2026.68.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Syslifters/sysreptor/commit/1981717f15afe945aa86d7e0dc9dc30a30c88dea
https://github.com/Syslifters/sysreptor/releases/tag/2026.68
https://github.com/Syslifters/sysreptor/security/advisories/GHSA-wgx3-84xg-q93j

Configurations

No configuration.

History

18 Sep 2026, 18:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-18 18:17

Updated : 2026-09-21 21:17

NVD link : CVE-2026-81181

Mitre link : CVE-2026-81181

CVE.ORG link : CVE-2026-81181

JSON object : View

Products Affected

No product.

CWE

CWE-384

Session Fixation

{"id": "CVE-2026-81181", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-81181", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-18T19:30:39.522705Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Syslifters", "product": "sysreptor", "versions": [{"status": "affected", "version": "< 2026.68"}]}]}], "published": "2026-09-18T18:17:15.963", "references": [{"url": "https://github.com/Syslifters/sysreptor/commit/1981717f15afe945aa86d7e0dc9dc30a30c88dea", "source": "security-advisories@github.com"}, {"url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.68", "source": "security-advisories@github.com"}, {"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-wgx3-84xg-q93j", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-384"}]}], "descriptions": [{"lang": "en", "value": "SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor session cookie, place it in a victim's browser, and know the shared-note URL where the victim authenticates can reuse the fixed session after the victim enters the correct password and access that shared note. The main SysReptor login flow is not affected. This issue is fixed in version 2026.68."}], "lastModified": "2026-09-21T21:17:13.103", "sourceIdentifier": "security-advisories@github.com"}