High severity · published Sep 27, 2025
CVE-2025-59945
SysReptor Susceptible to Privilege Escalation by Authenticated Users
8.1
CVSS
0.3%
EPSS
No
On KEV
Description
SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can assign the is_project_admin permission to their own user. This allows users to read, modify and delete pentesting projects they are not members of and are therefore not supposed to access. This issue has been patched in version 2025.83.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
sysreptor · Syslifters
>= 2024.74, < 2025.83 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59945
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59945
Patch
https://github.com/Syslifters/sysreptor/commit/de8b5d89d0644479ee0da0a113c6bcc2436ba7f4
Vendor Advisory
https://github.com/Syslifters/sysreptor/security/advisories/GHSA-r6hm-59cq-gjg6
More from sysreptor
8.8
CVE-2026-81180
SysReptor: Authenticated RCE by insecure image processing
8.8
CVE-2024-36076
Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in…
8.1
CVE-2026-81179
SysReptor: Host header injection might allow account takeover
6.8
CVE-2026-42291
SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional
5.4
CVE-2025-66561
SysReptor Vulnerable to an Authenticated Stored Cross-Site Scripting (XSS)