CVE-2026-81179: SysReptor: Host header injection might allow account takeover
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWEDHOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request a reset email whose link points to an attacker-controlled system, and a victim who follows that link can disclose the reset token, allowing the attacker to reset the victim's password and take over the account. Exploitation also requires a configured email gateway and an email address for the victim, while some reverse proxy configurations may reject the hostile Host header. This issue is fixed in version 2026.58.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SysReptorto a version that resolves this vulnerability.Fixed in 2026.58 - Configuration
Ensure ALLOWED_HOSTS does not use a wildcard that would allow an attacker-controlled Host header when generating password reset links (issue described for installations prior to 2026.58 that configure ALLOWED_HOSTS with a wildcard).
SysReptor ALLOWED_HOSTS = (no wildcard for untrusted hosts)
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments are SysReptor versions before 2026.58 that have password reset by email enabled and configure ALLOWED_HOSTS with a wildcard. Exploitation also depends on a configured email gateway; some reverse proxies may reject the malicious Host header.
What does an attacker need to exploit it?
The attacker does not need an account, but needs the target victim's email address and must be able to submit a password-reset request with an attacker-controlled Host header. The victim must then follow the reset link delivered by email and disclose the reset token to the attacker-controlled system.
Are default configurations affected?
The provided information identifies the wildcard ALLOWED_HOSTS setting and email-based password resets as required conditions. It does not state whether either setting is enabled by default.
What can be done before upgrading?
Disable email password resets or remove the wildcard from ALLOWED_HOSTS. Ensure any reverse proxy rejects untrusted Host headers; this may prevent the hostile header from reaching SysReptor.
How can administrators determine whether they are affected?
Check whether the installation is older than 2026.58, has email password resets enabled, uses a wildcard in ALLOWED_HOSTS, and has a configured email gateway. Also review reverse-proxy Host-header validation, since configurations that reject hostile Host headers may block exploitation.