CVE-2026-77767

Name of the Vulnerable Software and Affected Versions Reconmap (affected versions not specified)

Description An authorization bypass exists in the API due to a fallback policy in apps/api/app/Program.cs that is bypassed by the [AllowAnonymous] attribute in apps/api/app/Controllers/ReportsController.cs. The PreviewReport function loads project and organization data based on the id path segment without performing authentication, project membership, or role checks. Since the id is an auto-increment primary key, unauthenticated remote callers can use sequential IDs to retrieve sensitive penetration-testing engagement details and client organization information, including names, addresses, and URLs. Additionally, the 404 responses reveal the existence of specific project IDs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.