CVE-2026-81178

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81178
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81178.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81178
Aliases
  • GHSA-926c-j47w-8f9c
Published
2026-09-18T17:44:42Z
Modified
2026-09-20T11:47:27Z
Severity
  • 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
SysReptor: Anonymous note-share link discloses project member identities and non-shared note activity
Details

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and forwards client information, connection, awareness, and deletion events without consistently restricting them to the shared note subtree. The disclosed metadata can identify project members through usernames and names and reveal the identifiers and live editing activity of notes that were not shared. The content of non-shared notes remains protected, and the issue does not grant write access. This issue is fixed in version 2026.55.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81178.json"
}
References

Affected packages

Git / github.com/syslifters/sysreptor

Affected ranges

Type
GIT
Repo
https://github.com/syslifters/sysreptor
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1e52e5058b0c7f420dc45c87ad72e7a4585477b1
Fixed
348dd197b326185cc648de48f1582225fa9e1c7d
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2026.55"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.101
0.102
0.110
0.83
0.87
0.89
0.95
0.96
2023.*
2023.114
2023.119
2023.122
2023.128
2023.136
2023.142
2023.145
2024.*
2024.1
2024.10
2024.13
2024.16
2024.19
2024.20
2024.28
2024.29
2024.3
2024.30
2024.40
2024.43
2024.49
2024.55
2024.57
2024.58
2024.60
2024.61
2024.63
2024.68
2024.69
2024.70
2024.74
2024.79
2024.8
2024.81
2024.91
2024.96
2025.*
2025.102
2025.104
2025.108
2025.110
2025.12
2025.20
2025.25
2025.29
2025.37
2025.4
2025.43
2025.50
2025.56
2025.64
2025.69
2025.74
2025.80
2025.81
2025.83
2025.90
2025.94
2025.96
2026.*
2026.1
2026.12
2026.18
2026.21
2026.25
2026.27
2026.29
2026.36
2026.4
2026.42
2026.50

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81178.json"