CVE-2026-44987CWE-269

SysReptor: Privilege Escalation from User Admin to Superuser

Low · published May 8, 2026

CVSS v3.1
3.8
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of users with "Superuser" permissions. If the SysReptor installation has the "Forgot Password" functionality enabled (non-default), they can reset the Superusers' passwords and authenticate, if the Superuser has no MFA enabled. User managers can then access the Django backend (/admin) or manipulate the settings of the SysReptor installation. Note that user managers have the ability to access all pentest projects by assigning themselves "Project Admin" permissions. This is intentional and by design. This issue has been patched in version 2026.29.

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00265 · 17.4th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-05-08T21:59Z
EPSS history
Timeline
  • 08 MAY 21:59Z
    SysReptor: Privilege Escalation from User Admin to Superuser
    cvelistv5