CVE-2026-44987

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44987", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-08T16:23:33.265Z", "datePublished": "2026-05-08T21:59:12.204Z", "dateUpdated": "2026-05-12T18:31:48.576Z"}, "containers": {"cna": {"title": "SysReptor: Privilege Escalation from User Admin to Superuser", "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "lang": "en", "description": "CWE-269: Improper Privilege Management", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-6x8f-v3cf-cvr3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-6x8f-v3cf-cvr3"}, {"name": "https://github.com/Syslifters/sysreptor/releases/tag/2026.29", "tags": ["x_refsource_MISC"], "url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.29"}], "affected": [{"vendor": "Syslifters", "product": "sysreptor", "versions": [{"version": "< 2026.29", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T21:59:12.204Z"}, "descriptions": [{"lang": "en", "value": "SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with \"User Admin\" permissions can change the email addresses of users with \"Superuser\" permissions. If the SysReptor installation has the \"Forgot Password\" functionality enabled (non-default), they can reset the Superusers' passwords and authenticate, if the Superuser has no MFA enabled. User managers can then access the Django backend (/admin) or manipulate the settings of the SysReptor installation. Note that user managers have the ability to access all pentest projects by assigning themselves \"Project Admin\" permissions. This is intentional and by design. This issue has been patched in version 2026.29."}], "source": {"advisory": "GHSA-6x8f-v3cf-cvr3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-12T13:00:12.318338Z", "id": "CVE-2026-44987", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T18:31:48.576Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44987", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T13:00:12.318338Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T13:00:18.770Z"}}], "cna": {"title": "SysReptor: Privilege Escalation from User Admin to Superuser", "source": {"advisory": "GHSA-6x8f-v3cf-cvr3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Syslifters", "product": "sysreptor", "versions": [{"status": "affected", "version": "< 2026.29"}]}], "references": [{"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-6x8f-v3cf-cvr3", "name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-6x8f-v3cf-cvr3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.29", "name": "https://github.com/Syslifters/sysreptor/releases/tag/2026.29", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with \"User Admin\" permissions can change the email addresses of users with \"Superuser\" permissions. If the SysReptor installation has the \"Forgot Password\" functionality enabled (non-default), they can reset the Superusers' passwords and authenticate, if the Superuser has no MFA enabled. User managers can then access the Django backend (/admin) or manipulate the settings of the SysReptor installation. Note that user managers have the ability to access all pentest projects by assigning themselves \"Project Admin\" permissions. This is intentional and by design. This issue has been patched in version 2026.29."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269: Improper Privilege Management"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-08T21:59:12.204Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44987", "state": "PUBLISHED", "dateUpdated": "2026-05-12T18:31:48.576Z", "dateReserved": "2026-05-08T16:23:33.265Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-08T21:59:12.204Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "sysreptor", "vendor": "Syslifters", "versions": [{"status": "affected", "version": "< 2026.29"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with \"User Admin\" permissions can change the email addresses of users with \"Superuser\" permissions. If the SysReptor installation has the \"Forgot Password\" functionality enabled (non-default), they can reset the Superusers' passwords and authenticate, if the Superuser has no MFA enabled. User managers can then access the Django backend (/admin) or manipulate the settings of the SysReptor installation. Note that user managers have the ability to access all pentest projects by assigning themselves \"Project Admin\" permissions. This is intentional and by design. This issue has been patched in version 2026.29."}, {"lang": "es", "value": "SysReptor es una plataforma de informes de pentesting totalmente personalizable. Antes de la versi\u00f3n 2026.29, los usuarios con permisos de 'Administrador de Usuarios' pueden cambiar las direcciones de correo electr\u00f3nico de los usuarios con permisos de 'Superusuario'. Si la instalaci\u00f3n de SysReptor tiene la funcionalidad de 'Olvid\u00e9 mi Contrase\u00f1a' habilitada (no predeterminada), pueden restablecer las contrase\u00f1as de los Superusuarios y autenticarse, si el Superusuario no tiene MFA habilitado. Los administradores de usuarios pueden entonces acceder al backend de Django (/admin) o manipular la configuraci\u00f3n de la instalaci\u00f3n de SysReptor. Tenga en cuenta que los administradores de usuarios tienen la capacidad de acceder a todos los proyectos de pentesting asign\u00e1ndose a s\u00ed mismos permisos de 'Administrador de Proyecto'. Esto es intencional y por dise\u00f1o. Este problema ha sido parcheado en la versi\u00f3n 2026.29."}], "id": "CVE-2026-44987", "lastModified": "2026-07-24T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44987", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-12T13:00:12.318338Z", "version": "2.0.3"}}]}, "published": "2026-05-08T23:16:39.917", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.29"}, {"source": "security-advisories@github.com", "url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-6x8f-v3cf-cvr3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2026.29)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "sysreptor", "source": "cna", "vendor": "Syslifters"}, "product": "sysreptor", "vendor": "syslifters"}], "created": "2026-05-09T00:30:21.262500+00:00", "updated": "2026-05-09T00:45:21.339868+00:00", "vendors": ["syslifters", "syslifters$PRODUCT$sysreptor"]}