CVE-2026-81181

Name of the Vulnerable Software and Affected Versions SysReptor versions prior to 2026.68

Description The password authentication flow for protected shared notes fails to rotate the session identifier after successful authentication, leading to session fixation. This occurs when an attacker obtains an unauthenticated session cookie and places it in a victim's browser. If the attacker also knows the shared-note URL where the victim authenticates, they can reuse the fixed session to access the shared note after the victim provides the correct password. The main login flow is not affected.

Recommendations Update to version 2026.68.