A high severity vulnerability in SysReptor allows unauthenticated attackers to hijack user accounts by manipulating password reset emails.

This vulnerability involves a reliance on untrusted inputs in a security decision (CWE-807), where the application accepts a user-controlled Host header to construct password reset links. An unauthenticated attacker can trigger a request that forces the system to send a reset token to a domain controlled by the attacker.

The ability for an attacker to intercept password reset tokens leads to complete account takeover of any target user, including administrative accounts. Given the CVSS score of 8.1, this flaw poses a significant risk to the integrity and confidentiality of the pentest reporting platform. Successful exploitation could result in unauthorized access to sensitive vulnerability data and client reports, leading to severe reputational and security damage.

Immediate Action: Update SysReptor to version 2026.58 or later to incorporate the patch which mitigates Host header manipulation.

Proactive Monitoring: Review system access logs for anomalous HTTP requests containing non-standard Host headers or repeated password reset requests originating from suspicious IP addresses.

Compensating Controls: Configure reverse proxies or Web Application Firewalls (WAF) to strictly validate the Host header against a whitelist of authorized domains, effectively blocking requests that attempt to inject malicious host values.

Public Exploit Available: No

Organizations utilizing SysReptor must prioritize the transition to version 2026.58 to close this critical account takeover vector. Administrators should verify their configuration files to ensure that ALLOWED_HOSTS is explicitly defined rather than using a wildcard, which is a prerequisite for this exploit. Failure to update the software creates an unacceptable risk of unauthorized access to sensitive assessment data.