CVE-2026-77767 describes an improper access control vulnerability in Reconmap's API where the report preview endpoint in ReportsController.cs is decorated with [AllowAnonymous], bypassing the global administrator-only authorization policy. The PreviewReport action loads project and client organisation data using a sequential auto-increment integer ID without any authentication, membership, or role check. An unauthenticated remote attacker can enumerate all project IDs sequentially and extract sensitive penetration-testing engagement details including project names, descriptions, and client organisation information such as name, address, and URL. The 404 response for missing IDs further aids enumeration by revealing which project IDs exist. Since Reconmap is used to manage penetration-testing engagements, the exposed data is highly sensitive by nature. A fix is available via a specific commit to the repository.