Privilege Escalation Vulnerability in SysReptor by Syslifters
CVE-2025-59945

8.1HIGH

Key Information:

Vendor

Syslifters

Status
Sysreptor
Vendor
CVE Published:
27 September 2025

What is CVE-2025-59945?

In versions ranging from 2024.74 to before 2025.83 of SysReptor, a pentest reporting platform, an issue exists that permits authenticated non-admin users to assign the 'is_project_admin' permission to themselves. This malicious capability allows unauthorized users to read, modify, and delete pentesting projects, breaching access restrictions and compromising sensitive information. The vulnerability has been addressed in version 2025.83.

Affected Version(s)

sysreptor >= 2024.74, < 2025.83

References

https://github.com/Syslifters/sysreptor/security/advisori...
x_refsource_CONFIRM
https://github.com/Syslifters/sysreptor/commit/de8b5d89d0...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-59945 : Privilege Escalation Vulnerability in SysReptor by Syslifters