Live › vulnerability › CVE-2026-115975
Go to dashboardCervantes v1.3-beta has a broken access control flaw in its JiraController, so a user can create, edit, or delete Jira tickets belonging to other projects. An attacker with access to the app can tamper with vulnerability tracking records they should not be able to touch.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 08:47 UTC. All times on this page are UTC.
Teams running Cervantes v1.3-beta with the Jira integration in use are exposed, since the flaw is in the controller that handles Jira tickets. Deployments without the Jira integration or on a different version are unlikely to be affected, but the sources do not confirm which configurations are vulnerable.
No product ranges from the sources yet.
v1.3-beta: unknown fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects
This page as .md · .json · in your agent: get_signal("CVE-2026-115975")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.