Authorization Bypass in Reconmap Report Preview Endpoint

Reconmap contains an authorization bypass vulnerability (CVE-2026-77767) located within the API implementation of the report preview functionality. The application's global fallback authorization policy, defined in apps/api/app/Program.cs, is intended to enforce administrative role requirements. However, the PreviewReport action in apps/api/app/Controllers/ReportsController.cs is incorrectly decorated with an [AllowAnonymous] attribute, which explicitly opts the endpoint out of this protection.

The vulnerability allows an unauthenticated remote attacker to access the report preview functionality without performing any project membership or role-based access checks. Because the endpoint identifies projects using their auto-incrementing primary key, an attacker can programmatically iterate through these IDs to extract the names, descriptions, and client organization details for all projects hosted on an instance. The endpoint also returns distinct error codes (404) for non-existent IDs, facilitating the discovery of valid project ranges. This impact is significant as Reconmap is used to store sensitive penetration-testing engagement data.

Impact

Successful exploitation allows for the large-scale, automated exfiltration of sensitive client information, including addresses, URLs, and specific penetration-testing engagement descriptions. Because the underlying IDs are sequential, the total dataset of an organization's engagements and associated client records is at risk of full disclosure.

Recommendation

Prioritize patching the affected Reconmap installation to remediate CVE-2026-77767. If immediate patching is not possible, implement WAF or network-level access controls to restrict access to the /api/reports/preview/ (or equivalent) endpoint to authenticated internal network ranges. Monitor webserver logs for high volumes of 404 responses or sequential requests to report preview endpoints originating from single IP addresses, which indicates an enumeration attempt.