---
id: "CVE-2026-115975"
kind: "vulnerability"
aliases: ["CVE-2026-115975"]
title: "Cervantes: broken access control lets users change other projects' Jira tickets"
severity: "high"
cvss: 7.1
epss: 0.00288
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cervantes", "jira", "package", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-24T08:16:52+00:00"
first_seen_at: "2026-10-24T08:47:15+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115975", "first_seen_at": "2026-10-24T08:47:15+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115975", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Cervantes: broken access control lets users change other projects' Jira tickets

Cervantes v1.3-beta has a broken access control flaw in its JiraController, so a user can create, edit, or delete Jira tickets belonging to other projects. An attacker with access to the app can tamper with vulnerability tracking records they should not be able to touch.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether Cervantes is deployed and which version is running: unknown
- Check whether the Jira integration (JiraController) is enabled in the deployment: unknown

## Fix

- Upgrade Cervantes past `v1.3-beta`: unknown fixed version
- Until a fix ships, restrict access to the Cervantes instance and review Jira tickets for unexpected changes: unknown

## Timeline

- 2026-10-24T08:47:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115975
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115975

## From the sources

Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_