CVE-2026-77767
Received Received - Intake

Reconmap API Unauthenticated Project Data Exposure via Report Preview

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: VulnCheck

Description
Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/app/Controllers/ReportsController.cs carries [AllowAnonymous] and therefore opts out of that policy. PreviewReport loads the Project row named by the id path segment, loads the linked Organisation through the project's ClientId, and renders both into default-report-template.html, which prints the project name and description together with the client organisation's name, address and URL. No authentication, project membership or role check is performed. Because the id is the auto-increment primary key of the project table, an unauthenticated remote caller can walk sequential ids to retrieve the engagement details and client organisation of every project on the instance, and the 404 returned for a missing id reveals which project ids exist. Reconmap stores penetration-testing engagements, so the disclosed descriptions and client records are sensitive by nature.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-77767
EUVD
EUVD-2026-63900

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
reconmap reconmap *
reconmap reconmap to 3.2.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77767 is a missing authorization vulnerability in Reconmap's API. The report preview endpoint allows unauthenticated access due to an [AllowAnonymous] attribute, bypassing default admin-only checks. Attackers can enumerate project IDs to retrieve sensitive project details and client organization information without any authentication or role requirements.

Detection Guidance

To detect this vulnerability, check if the endpoint GET /api/reports/{id}/preview is accessible without authentication. Use curl to test sequential project IDs and observe if responses reveal project details. Example: curl -i http://<target>/api/reports/1/preview. If 200 responses return sensitive data or 404s indicate valid IDs, the vulnerability exists.

Impact Analysis

This flaw enables attackers to access confidential data including project names, descriptions, engagement scope notes, and client organization details like names, addresses, and URLs. Since project IDs are sequential, enumeration is trivial, and 404 responses reveal existing IDs. This poses a high risk for data breaches in security testing environments.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to sensitive personal and health-related data. GDPR requires strict access controls for personal data, while HIPAA mandates protection of protected health information. The exposure of client and project details could result in non-compliance, legal penalties, and reputational damage.

Mitigation Strategies

Immediately remove the [AllowAnonymous] attribute from the report preview endpoint in ReportsController.cs. Ensure all endpoints enforce authentication and role checks. Update to the latest Reconmap version where this issue is patched. Monitor network traffic for unauthorized access attempts to the preview endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77767. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart