CVE-2026-42291

SysReptor is a fully customizable pentest reporting platform. From version 2026.4 to before version 2026.27, the endpoints for reading and creating sharing links for personal notes is not properly authorized. This allows authenticated attackers who obtain the note ID of victim users to list and...

PT-2026-39204

Name of the Vulnerable Software and Affected Versions SysReptor versions 2026.4 through 2026.26 Description Improper authorization in endpoints used for reading and creating sharing links for personal notes allows authenticated attackers with a victim's note ID to list and create sharing links to...