Cross-user note read-write access via unchecked sharing endpoints

Authorization bypass in Syslifters GmbH SysReptor 2026.4 through 2026.25 allows remote authenticated users to read and write other users' notes. The personal-note sharing endpoints accept a victim's note ID when listing or creating sharing links without checking that the requester owns the note or is authorized to access it. Exploitation requires a valid account and knowledge of the victim note ID; Professional deployments expose cross-user impact, while Community users already have superuser access.