Low 3.5Published Sep 18, 2026

CVE-2026-81178SysReptor: Anonymous note-share link discloses project member identities and non-shared note activity

Updated under an hour ago (2026-10-19 09:20 UTC)

Does this affect you?

It affects Syslifters sysreptor. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Syslifters sysreptor

Exploited in the last 30 days

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and forwards client information, connection, awareness, and deletion events without consistently restricting them to the shared note subtree. The disclosed metadata can identify project members through usernames and names and reveal the identifiers and live editing activity of notes that were not shared. The content of non-shared notes remains protected, and the issue does not grant write access. This issue is fixed in version 2026.55.

CVSS: 3.5 LOW (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-863
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Sep 18, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Syslifters sysreptor syslifters:sysreptor (from the name)	before 2026.55	CNA record

References

https://github.com/Syslifters/sysreptor/security/advisories/GHSA-926c-j47w-8f9cx-refsource-confirm
https://github.com/Syslifters/sysreptor/commit/1e52e5058b0c7f420dc45c87ad72e7a4585477b1x-refsource-misc
https://github.com/Syslifters/sysreptor/releases/tag/2026.55x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.