Listen to this Post
The vulnerability CVE-2025-59945 affects the SysReptor pentest reporting platform. It exists in versions starting from 2024.74 up to, but not including, version 2025.83. The core flaw is in the application’s permission assignment logic. Authenticated users who do not have administrative privileges can exploit this flaw. They can send a specific request to the platform’s user permission endpoint. This request allows them to assign the elevated ‘is_project_admin’ permission flag to their own account. The application fails to validate whether the user has the right to modify their own permissions in this way. This missing authorization check is the root cause of the security issue. As a result, a standard authenticated session is sufficient to perform this action. No initial special privileges or group memberships are required. After successfully assigning the permission, the user’s account is granted project administrator rights. This elevated access applies across the entire platform, not just to specific projects. Consequently, the user can view all pentesting projects stored in the system. They can also modify the content and findings within any project. Furthermore, they gain the ability to delete projects entirely. This breach of access controls compromises the confidentiality of sensitive pentest data. It also threatens the integrity of reports and project management. The vulnerability allows a breach of the intended security boundary between different user roles. It effectively turns a low-privilege user into a platform-wide project admin. The issue was corrected in version 2025.83 by implementing proper checks on the permission modification function.
Platform: SysReptor
Version: 2024.74-2025.82
Vulnerability: Permission self-assignment
Severity: Critical
date: 2025-09-26
Prediction: Patched in 2025.83
What Undercode Say:
Analytics
Check the current SysReptor version docker exec sysreptor_app cat /app/VERSION Example curl to test for vulnerable endpoint curl -s -H "Authorization: Bearer $TOKEN" http://sysreptor-host/api/user/self/permissions | grep is_project_admin Python snippet to verify local version import sysreptor_client print(sysreptor_client.get_version())
How Exploit
An attacker with a valid low-privilege account logs into SysReptor. They then send an HTTP POST request to the user permissions API endpoint. The request targets their own user ID and adds the ‘is_project_admin’ permission. The vulnerable system processes this request without verifying the user’s authority. The attacker’s session then receives administrative project access, allowing full data manipulation.
Protection from this CVE
Immediately upgrade SysReptor to version 2025.83 or later. This update contains the fix that validates user authority before permission changes. If immediate upgrade is not possible, restrict network access to the SysReptor instance. Also, audit user permission logs for any unauthorized ‘is_project_admin’ assignments.
Impact
Unauthorized read access to all pentesting projects. Unauthorized modification and deletion of any project data. Complete compromise of project confidentiality and report integrity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
