CVE-2026-81182

Name of the Vulnerable Software and Affected Versions SysReptor versions prior to 2026.68

Description An unauthenticated attacker with a public read-write note share link can disclose uploaded files or images within the same project. By updating the shared note to reference a specific target asset filename, the attacker bypasses authorization logic, which incorrectly treats the asset as permitted and allows it to be downloaded. This requires the attacker to know the asset filename and does not allow access to assets in other projects.

Recommendations Update to version 2026.68.