The vulnerability allows an authenticated user to create or list sharing links for another user's personal notes without any authorization. This provides the attacker with both read and write capabilities on those notes, effectively enabling unauthorized data manipulation. The flaw aligns with CWE‑639, reflecting a lack of proper access control checks.

Syslifters’ SysReptor platform is affected, specifically versions from 2026.4 through 2026.26. Both the Professional and Community editions are vulnerable; however, in Community the same permissions already grant all users superuser access to personal notes, so the impact is limited there. The issue is patched in release 2026.27.

The CVSS score is 6.8, indicating a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and have knowledge of the victim's note ID to exploit the flaw. Once accessed, they can read and modify notes, compromising confidentiality and integrity of user data.