Medium severity · published Oct 24, 2026
CVE-2026-115998
IDOR: User reads and modifies findings from other people's projects
New
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
cervantes · CervantesSec
alpha 0.3 through 1.3-beta · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115998
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115998
www.grayback.es
https://www.grayback.es/advisories
www.grayback.es
https://www.grayback.es/en/advisories
More from cervantes
7.1
CVE-2026-115975
Broken access control in JiraController
6.8
CVE-2026-115993
Stored XSS in the “Notes” field of project checklists
5.4
CVE-2026-115994
BOLA Allows Cross-Project Target Tampering
5.4
CVE-2024-42054
Cervantes through 0.5-alpha accepts insecure file uploads
5.4
CVE-2024-42055
Cervantes through 0.5-alpha allows stored XSS