{"id":"CVE-2026-115975","kind":"vulnerability","aliases":["CVE-2026-115975"],"related":[],"title":"Cervantes: broken access control lets users change other projects' Jira tickets","description":"Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects","summary":"Cervantes v1.3-beta has a broken access control flaw in its JiraController, so a user can create, edit, or delete Jira tickets belonging to other projects. An attacker with access to the app can tamper with vulnerability tracking records they should not be able to touch.","severity":"high","cvss":7.1,"epss":0.00288,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cervantes","jira","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Confirm whether Cervantes is deployed and which version is running: unknown\n- Check whether the Jira integration (JiraController) is enabled in the deployment: unknown","fix":"- Upgrade Cervantes past `v1.3-beta`: unknown fixed version\n- Until a fix ships, restrict access to the Cervantes instance and review Jira tickets for unexpected changes: unknown","status":"open","published_at":"2026-10-24T08:16:52+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","triaged_at":"2026-10-25T03:30:01+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:30:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cervantes past `v1.3-beta`: unknown fixed version\n- Until a fix ships, restrict access to the Cervantes instance and review Jira tickets for unexpected changes: unknown","reach":"unknown","title":"Cervantes: broken access control lets users change other projects' Jira tickets","impact":"medium","summary":"Cervantes v1.3-beta has a broken access control flaw in its JiraController, so a user can create, edit, or delete Jira tickets belonging to other projects. An attacker with access to the app can tamper with vulnerability tracking records they should not be able to touch.","category":"package","nicknames":[],"who_cares":["cervantes","jira","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker alters or deletes Jira tickets in other projects","analyst_note":"Check the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-115975) for the fixed version, required privileges, and whether the Jira integration must be enabled.","how_to_check":"- Confirm whether Cervantes is deployed and which version is running: unknown\n- Check whether the Jira integration (JiraController) is enabled in the deployment: unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams running Cervantes v1.3-beta with the Jira integration in use are exposed, since the flaw is in the controller that handles Jira tickets. Deployments without the Jira integration or on a different version are unlikely to be affected, but the sources do not confirm which configurations are vulnerable.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000627,"input_tokens":3276,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115975':14A,17A '-2026':13A,16A 'abl':66B 'access':3A,29B,52B,70C 'allow':79C 'app':55B 'attack':50B,81C 'belong':45B 'broken':2A,28B,69C 'cervant':1A,18B,24B,75C 'chang':7A 'control':4A,30B,71C 'could':78C 'creat':39B,83C 'cve':12A,15A 'delet':42B,86C 'edit':40B,84C 'flaw':31B 'host':23B 'jira':10A,19B,43B,87C 'jiracontrol':34B,73C 'let':5A 'packag':20B 'project':9A,48B,93C 'record':61B 'self':22B 'self-host':21B 'tamper':57B 'ticket':11A,44B,88C 'touch':68B 'track':60B 'user':6A,37B 'v1.3-beta':25B,77C 'version':76C 'vulner':59B,90C","nicknames":[],"mitigations":[],"who_affected":"Teams running Cervantes v1.3-beta with the Jira integration in use are exposed, since the flaw is in the controller that handles Jira tickets. Deployments without the Jira integration or on a different version are unlikely to be affected, but the sources do not confirm which configurations are vulnerable.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T08:16:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","cvss_by":"772f0079-75c2-41ca-913e-d9072716578b","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115975","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115975","severity":null,"published_at":"2026-10-24T08:16:52+00:00","modified_at":"2026-10-24T08:16:52+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","fetched_at":"2026-10-24T08:47:15+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115975","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115975","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}