CVE-2026-115998mediumCWE-639

CVE-2026-115998: medium-severity vulnerability in CervantesSec cervantes

IDOR: User reads and modifies findings from other people's projects

Published

Follow this CVE+ Monitor cervantes

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.2%
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
CervantesSec · cervantes
Related CVEs — CervantesSec cervantes

In the same product, most dangerous first.

CVE-2026-115993MEDIUMStored XSS in the “Notes” field of project checklistsEPSS 0.3%CVE-2026-115994MEDIUMBOLA Allows Cross-Project Target TamperingEPSS 0.2%CVE-2026-115975HIGHBroken access control in JiraControllerEPSS 0.2%