CVE-2026-77767

CVE-2026-77767 exposes penetration-testing engagement records from a Reconmap instance through an API endpoint that requires no authentication and uses sequential numeric IDs. The exposed data includes client organization names, addresses, URLs, project names, and project descriptions. The vulnerability has been assigned CVSS 7.5, but this score materially understates the operational risk because it treats the disclosure as generic sensitive data when the reality is worse. The critical distinction is that organizations actively engaged with a penetration-testing firm are not passive data holders — they are organizations that have already identified their own vulnerabilities through the assessment process. Project descriptions encode the client's own threat model: a "PCI-DSS compliance audit" reveals cardholder data handling, "Active Directory enumeration" signals a Windows-centric identity infrastructure worth compromising, and "cloud infrastructure review" confirms AWS or Azure exposure. An attacker who enumerates the engagement portfolio gains not just client names but intelligence about which targets are already known to have specific vulnerability classes. This is pre-attack reconnaissance against a self-selected population of security-conscious organizations. The sequential ID enumeration compounds the problem. The 404 response distinguishes existing from non-existent projects, enabling complete mapping of the client portfolio in minutes. Worse, the temporal dimension creates ongoing risk: each day the vulnerability remains unpatched, an attacker can track engagement phases — which clients just started assessments (fresh vulnerability data), which are nearing completion (meaningful remediations recently deployed), and which are dormant (potentially abandoned hardening). This is a rolling intelligence asset, not a static leak. The [AllowAnonymous] attribute on a controller returning client data represents a systemic authorization bypass pattern, not an isolated misconfiguration. This pattern typically emerges when developers face a choice between restructuring authentication for external report sharing versus dropping a single attribute — the insecure path takes seconds, the secure path requires redesign. Audit other controllers for similar bypasses, particularly on export and sharing-adjacent endpoints. Prioritize remediation not because the data is sensitive in isolation, but because it gives attackers a targeting advantage against organizations that are, by definition, in a transitional security state with known weaknesses.

Reviewed through automated stages and approved by a human before publication.