Reconmap API Anonymous Access Bypasses Authorization Policy

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/app/Controllers/ReportsController.cs carries [AllowAnonymous] and therefore opts out of that policy. PreviewReport loads the Project row named by the id path segment, loads the linked Organisation through the project's ClientId, and renders both into default-report-template.html, which prints the project name and description together with the client organisation's name, address and URL. No authentication, project membership or role check is performed. Because the id is the auto-increment primary key of the project table, an unauthenticated remote caller can walk sequential ids to retrieve the engagement details and client organisation of every project on the instance, and the 404 returned for a missing id reveals which project ids ex

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-77767 is an authorization bypass vulnerability in Reconmap's API where the PreviewReport endpoint incorrectly uses the [AllowAnonymous] attribute, exempting it from the mandatory administrator role requirement enforced by the application's fallback authorization policy. This allows unauthenticated attackers to access sensitive project and organization data without proper credentials. The vulnerability affects Reconmap deployments where the API is exposed, potentially compromising confidentiality of security assessment reports, project details, and organizational information that should be restricted to authenticated administrators.

Casky's 283 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns underlying this CVE across MITRE ATT&CK Privilege Escalation (TA0004) and Credential Access (TA0006) tactics. Practitioners using Casky would identify suspicious findings including: unauthenticated API requests succeeding against endpoints decorated with [AllowAnonymous] when they should require administrator authentication; enumeration of project IDs and organization data through the PreviewReport endpoint without credentials; and inconsistent authorization enforcement where default-deny policies are bypassed by explicit attribute overrides. The skills would flag mismatches between declared security controls (fallback authorization) and actual endpoint behavior, revealing the gap in CWE-862 (Missing Authorization) that allows anonymous callers to access protected resources.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-77767.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-77767

Casky has 283 skills that investigate the attack patterns behind CVE-2026-77767. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn