CVE-2026-115998mediumCWE-639

CVE-2026-115998: falha de média gravidade em CervantesSec cervantes

IDOR: User reads and modifies findings from other people's projects

Publicada em

Seguir esta CVE+ Monitorar cervantes

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.2%
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
CervantesSec · cervantes
CVEs relacionadas — CervantesSec cervantes

No mesmo produto, das mais perigosas para as menos.

CVE-2026-115993MEDIUMStored XSS in the “Notes” field of project checklistsEPSS 0.3%CVE-2026-115994MEDIUMBOLA Allows Cross-Project Target TamperingEPSS 0.2%CVE-2026-115975HIGHBroken access control in JiraControllerEPSS 0.2%