Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-44987SysReptor: Privilege Escalation from User Admin to Superuser

Low 3.8

In plain English

A low-severity privilege mismanagement in sysreptor from Syslifters. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.2%top 94.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of users with "Superuser" permissions. If the SysReptor installation has the "Forgot Password" functionality enabled (non-default), they can reset the Superusers' passwords and authenticate, if the Superuser has no MFA enabled. User managers can then access the Django backend (/admin) or manipulate the settings of the SysReptor installation. Note that user managers have the ability to access all pentest projects by assigning themselves "Project Admin" permissions. This is intentional and by design. This issue has been patched in version 2026.29.

Affected products (as reported)

Vendor	Product	Versions
Syslifters	sysreptor	< 2026.29

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/Syslifters/sysreptor/security/advisories/GHSA-6x8f-v3cf-cvr3 x_refsource_CONFIRM
https://github.com/Syslifters/sysreptor/releases/tag/2026.29 x_refsource_MISC