CVE-2026-115998 Details
Description
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.
An Insecure Direct Object Reference (IDOR) vulnerability has been identified in Cervantes version 1.3-beta. This vulnerability allows authenticated attackers to access sensitive information such as findings, proof-of-concept details, credentials, and client data from projects they are not associated with. Additionally, attackers can alter the statuses of findings and transfer them to their own projects, thereby compromising the confidentiality and integrity of the data.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 24, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.grayback.es/advisories | 772f0079-75c2-41ca-913e-d9072716578b | AdvisoryBundle |
| https://www.grayback.es/en/advisories | 772f0079-75c2-41ca-913e-d9072716578b | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | 772f0079-75c2-41ca-913e-d9072716578b |
Affected Products
| Product | Versions |
|---|---|
| Cervantes | v1.3-beta |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 24, 2026 | New CVE Received | 772f0079-75c2-41ca-913e-d9072716578b |