CVE-2025-59945CWE-266

CVE-2025-59945

High · published September 27, 2025

CVSS v3.1

8.1

EPSS

Percentile

25.7

In the wild

Unconfirmed

What it is

SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can assign the is_project_admin permission to their own user. This allows users to read, modify and delete pentesting projects they are not members of and are therefore not supposed to access. This issue has been patched in version 2025.83.

The record

Technical detail

CVSS v3.1: 8.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.00336 · 25.7th percentile
Weakness: CWE-266 · Incorrect Privilege Assignment
Published: 2025-09-27T05:15Z

Affected products (1)

Product	Versions	Fixed in
syslifters/sysreptor	≥ 2024.74, < 2025.83	2025.83

References (2)

https://github.com/Syslifters/sysreptor/commit/de8b5d89d0644479ee0da0a113c6bcc2436ba7f4 · [email protected]https://github.com/Syslifters/sysreptor/security/advisories/GHSA-r6hm-59cq-gjg6 · [email protected]

EPSS history

Timeline

27 SEP 01:01Z
SysReptor Susceptible to Privilege Escalation by Authenticated Users
cvelistv5