CVE-2026-81179

Name of the Vulnerable Software and Affected Versions SysReptor versions prior to 2026.58

Description Installations that enable password reset by email and configure ALLOWED HOSTS with a wildcard accept an attacker-controlled Host header during the generation of password reset links. An unauthenticated attacker can request a reset email containing a link that points to a system under their control. If a victim follows this link, the reset token is disclosed, enabling the attacker to reset the victim's password and take over the account. This exploitation requires a configured email gateway and the victim's email address, although some reverse proxy configurations may block the hostile Host header.

Recommendations Update to version 2026.58.