Cervantes BOLA lets users change other projects' targets
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
CervantesSec Cervantes versions from alpha 0.3 through 1.3-beta contain an authorization flaw in which object-level checks are missing, so the target identifier supplied by the user is trusted (CWE-639). An authenticated attacker can modify or delete targets that belong to other projects without authorization, which compromises the integrity of penetration testing scopes, results and associated security reports.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CervantesSec | cervantes | alpha 0.3 – 1.3-beta | v.1.4.0-beta | Patch available | CNA |
- cervantes VendorCervantesSec Affected alpha 0.3 – 1.3-beta Fixed in v.1.4.0-beta Patch available CNA
Remediation
Upgrade CervantesSec Cervantes to v.1.4.0-beta, which is the fixed version listed for this product.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA cervantes (CervantesSec) Fixed in v.1.4.0-beta
Timeline
- 2026-10-24 Threatist record created from CVE-2026-115994
- 2026-10-24 Alias added: GHSA-m7gg-rxfc-j545
- 2026-10-24 Priority changed: MEDIUM → LOW
- 2026-11-02 CISA SSVC decision points changed
More CervantesSec vulnerabilities
- TI-2026-80063 Broken access control in Cervantes JiraController CVSS 3.1HIGH 7.1
- TI-2026-80064 Stored XSS in the Notes field of Cervantes project checklists CVSS 3.1MEDIUM 6.8
- TI-2024-28061 Cervantes through 0.5-alpha allows stored XSS. CVSS 3.1MEDIUM 6.1
- TI-2024-28060 Cervantes through 0.5-alpha accepts insecure file uploads. CVSS 3.1MEDIUM 5.4
- TI-2026-80076 Cervantes lets users read and change findings in other projects CVSS 3.1MEDIUM 4.3
Sources
- CVE-2026-115994 · CVE Program
- CVE-2026-115994 · NVD
- FIRST EPSS
- GHSA-m7gg-rxfc-j545 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences