A critical authorization flaw in the Reconmap API allows unauthenticated remote attackers to gain unauthorized access to sensitive project reports and client information.

The application implements an insecure fallback authorization policy in the API, specifically within the report preview functionality. This allows unauthenticated users to bypass security controls and retrieve data that should be restricted to authorized users.

The exposure of project and client data can lead to severe reputational damage, breach of confidentiality agreements, and potential regulatory non-compliance. With a CVSS score of 7.5, this vulnerability represents a high-risk exposure of proprietary security assessment data.

Immediate Action: Upgrade to a version of Reconmap later than 3.2.2 which includes the authorization fix found in commit 2b2eb0cf0aa95726b4edd0045f86d2dcdb8de34d.

Proactive Monitoring: Review API access logs for anomalous traffic patterns or unauthorized requests directed at the report preview endpoints.

Compensating Controls: Restrict network access to the API interface to trusted IP addresses only, effectively creating an allow-list until the patch is applied.

Public Exploit Available: Unknown.

Given the sensitivity of the data managed by Reconmap, this vulnerability should be treated with high priority. Organizations must ensure that the API is properly secured by updating to the latest version and validating that authorization checks are correctly enforced across all endpoints.