CVE-2026-81182

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The user-controlled reference causes the shared-note authorization logic to treat the asset as permitted, after which the attacker can download it. The attacker must know the asset filename, and the issue does not permit cross-project access. This issue is fixed in version 2026.68.

• CWE-639

• https://github.com/Syslifters/sysreptor/commit/1b721e291ebadfc1457bc8d01f7c70fe5da4b035
• https://github.com/Syslifters/sysreptor/commit/1f3fd629c32560fc4280294f8f9bdc44d97c639a
• https://github.com/Syslifters/sysreptor/commit/f730c3acf9ee603f96bb05d598d20f6c4e958eb8
• https://github.com/Syslifters/sysreptor/releases/tag/2026.68
• https://github.com/Syslifters/sysreptor/security/advisories/GHSA-x3m3-v8pv-442r

Published

Sep 18, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-81176Svelte devalue is a JavaScript library that serializes value…5.3
• CVE-2026-81178SysReptor is a fully customizable pentest reporting platform…3.5
• CVE-2026-81179SysReptor is a fully customizable pentest reporting platform…8.1
• CVE-2026-8118The Royal Addons for Elementor – Addons and Templates Kit fo…6.5
• CVE-2026-81180SysReptor is a fully customizable pentest reporting platform…8.8
• CVE-2026-81181SysReptor is a fully customizable pentest reporting platform…3.7
• CVE-2026-8119A vulnerability was detected in Open5GS up to 2.7.7. Impacte…5.5
• CVE-2026-81192`OpenTelemetry.Resources.Host` NuGet package, which provides…7
• CVE-2026-81194The MasterStudy LMS WordPress Plugin WordPress plugin befor…4.3
• CVE-2026-81195The MasterStudy LMS WordPress Plugin WordPress plugin befor…5.3
• CVE-2026-81196The MasterStudy LMS WordPress Plugin WordPress plugin befor…2.7
• CVE-2026-81197The MasterStudy LMS WordPress Plugin WordPress plugin befor…5.3