A flaw in SysReptor allows a user with User Admin rights to modify the email addresses of users with Superuser permissions; if the application’s Forgot Password flow is enabled and the target Superuser has no multi‑factor authentication, the attacker can trigger a password reset and subsequently authenticate with superuser privileges. This grants full control of the Django administration interface and the ability to alter system settings and project permissions, effectively elevating the attacker’s authority over all pentest projects. The vulnerability represents a loss of isolation between privilege levels and is formally classified as CWE‑269.

Syslifters SysReptor versions earlier than 2026.29 are affected; the vulnerability exists in the core reporting platform used for pentest documentation and project management.

The CVSS score of 3.8 indicates a low severity risk when viewed in isolation, and the EPSS score is not available, implying limited publicly known exploitation activity. The issue is not listed in CISA’s KEV catalog. However, the attack vector, as inferred from the description, is internal: an attacker must already possess User Admin rights. Given that such users can alter Superuser email addresses, the compromise path is straightforward. Once the password is reset, the attacker can assume Superuser privileges, which provides complete administrative control over the platform.