CVE-2026-44987: SysReptor: Privilege Escalation from User Admin to Superuser
SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of users with "Superuser" permissions. If the SysReptor installation has the "Forgot Password" functionality enabled (non-default), they can reset the Superusers' passwords and authenticate, if the Superuser has no MFA enabled. User managers can then access the Django backend (/admin) or manipulate the settings of the SysReptor installation. Note that user managers have the ability to access all pentest projects by assigning themselves "Project Admin" permissions. This is intentional and by design. This issue has been patched in version 2026.29.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.29 - Configuration
If enabled (non-default), disable the “Forgot Password” functionality to prevent password resets of Superusers when the Superuser has no MFA enabled.
SysReptor (Forgot Password) Forgot Password functionality = disable - Configuration
Ensure Superuser accounts have MFA enabled to prevent authentication after password reset via enabled “Forgot Password”.
SysReptor (Superuser accounts) MFA enabled = enable - Configuration
For installations prior to version 2026.29, prevent “User Admin” users from changing the email addresses of users with “Superuser” permissions.
SysReptor (User Admin permission) User Admin capability to change Superuser email addresses = disable - Compensating control
Restrict assignment of “Project Admin” permissions to user managers, since users with “Project Admin” can access all pentest projects.
- Compensating control
Restrict access to the SysReptor Django backend (/admin) so that only authorized administrators can reach it.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44987?
CVE-2026-44987 is classified as a high-severity vulnerability due to the potential for privilege escalation.
How do I fix CVE-2026-44987?
To fix CVE-2026-44987, upgrade SysReptor to version 2026.29 or later to prevent User Admin users from changing Superuser email addresses.
Who is affected by CVE-2026-44987?
CVE-2026-44987 affects SysReptor installations prior to version 2026.29 that have User Admin and Superuser permissions.
What type of vulnerability is CVE-2026-44987?
CVE-2026-44987 is a privilege escalation vulnerability that allows users with User Admin permissions to gain Superuser access.
What can an attacker do with CVE-2026-44987?
An attacker exploiting CVE-2026-44987 can manipulate user permissions by changing Superuser email addresses, potentially leading to unauthorized access.