{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-77767/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-77767"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Reconmap"],"_cs_severities":["high"],"_cs_tags":["vulnerability","authentication-bypass","reconmap","cve-2026-77767"],"_cs_type":"advisory","_cs_vendors":["Reconmap"],"content_html":"\u003cp\u003eReconmap contains an authorization bypass vulnerability (CVE-2026-77767) located within the API implementation of the report preview functionality. The application's global fallback authorization policy, defined in apps/api/app/Program.cs, is intended to enforce administrative role requirements. However, the PreviewReport action in apps/api/app/Controllers/ReportsController.cs is incorrectly decorated with an [AllowAnonymous] attribute, which explicitly opts the endpoint out of this protection.\u003c/p\u003e\n\u003cp\u003eThe vulnerability allows an unauthenticated remote attacker to access the report preview functionality without performing any project membership or role-based access checks. Because the endpoint identifies projects using their auto-incrementing primary key, an attacker can programmatically iterate through these IDs to extract the names, descriptions, and client organization details for all projects hosted on an instance. The endpoint also returns distinct error codes (404) for non-existent IDs, facilitating the discovery of valid project ranges. This impact is significant as Reconmap is used to store sensitive penetration-testing engagement data.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the large-scale, automated exfiltration of sensitive client information, including addresses, URLs, and specific penetration-testing engagement descriptions. Because the underlying IDs are sequential, the total dataset of an organization's engagements and associated client records is at risk of full disclosure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize patching the affected Reconmap installation to remediate CVE-2026-77767. If immediate patching is not possible, implement WAF or network-level access controls to restrict access to the /api/reports/preview/ (or equivalent) endpoint to authenticated internal network ranges. Monitor webserver logs for high volumes of 404 responses or sequential requests to report preview endpoints originating from single IP addresses, which indicates an enumeration attempt.\u003c/p\u003e\n","date_modified":"2026-08-21T11:23:30Z","date_published":"2026-08-21T11:23:30Z","id":"https://feed.craftedsignal.io/briefs/2026-08-reconmap-auth-bypass/","summary":"An improper [AllowAnonymous] attribute in Reconmap's ReportsController allows unauthenticated remote attackers to perform enumeration of sensitive penetration testing engagement data by walking sequential project IDs.","title":"Authorization Bypass in Reconmap Report Preview Endpoint","url":"https://feed.craftedsignal.io/briefs/2026-08-reconmap-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-77767","version":"https://jsonfeed.org/version/1.1"}