CVE-2026-44987

SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of users with "Superuser" permissions. If the SysReptor installation has the "Forgot Password" functionality enabled (non-default), they can reset the Superusers' passwords and authenticate, if the Superuser has no MFA enabled. User managers can then access the Django backend (/admin) or manipulate the settings of the SysReptor installation. Note that user managers have the ability to access all pentest projects by assigning themselves "Project Admin" permissions. This is intentional and by design. This issue has been patched in version 2026.29.

• CWE-269

• https://github.com/Syslifters/sysreptor/releases/tag/2026.29
• https://github.com/Syslifters/sysreptor/security/advisories/GHSA-6x8f-v3cf-cvr3

Published

May 8, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4498Execution with Unnecessary Privileges (CWE-250) in Kibana’s …7.7
• CVE-2026-44981CrowdSec offers crowdsourced protection against malicious IP…8.2
• CVE-2026-44982CrowdSec offers crowdsourced protection against malicious IP…7.2
• CVE-2026-44983smallbitvec is a growable bit-vector for Rust, optimized for…7.3
• CVE-2026-44985Dozzle is a realtime log viewer for docker containers. Prior…9.6
• CVE-2026-44986Penpot is an open-source design tool for design and code col…9.9
• CVE-2026-44988LibVNCClient is a library for easy implementation of a VNC c…8.8
• CVE-2026-4499A vulnerability was determined in D-Link DIR-820LW 2.03. Aff…9.8
• CVE-2026-44990ApostropheCMS is an open-source Node.js content management s…9.3
• CVE-2026-44991OpenClaw before 2026.4.21 contains an authorization bypass v…4.2
• CVE-2026-44992OpenClaw versions 2026.4.5 before 2026.4.20 contain an envir…5
• CVE-2026-44993OpenClaw before 2026.4.20 contains a message classification …5.4