CVE-2026-81178

Name of the Vulnerable Software and Affected Versions SysReptor versions prior to 2026.55

Description An unauthenticated user with a public note share link can access project-wide collaborative editing metadata. This occurs because the public share consumer joins the same collaboration group as authenticated project members, allowing the forwarding of client information, connection, awareness, and deletion events without consistent restriction to the shared note subtree. This exposure can reveal project members' usernames and names, as well as the identifiers and live editing activity of notes that were not shared. The content of non-shared notes remains protected, and the issue does not provide write access.

Recommendations Update to version 2026.55.