Live › vulnerability › CVE-2026-115994
Go to dashboardCervantes v1.3-beta has a broken object-level authorization flaw (BOLA) that lets an attacker change or delete targets belonging to other projects. The sources say this can compromise penetration testing scopes, results and security reports.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 10:47 UTC. All times on this page are UTC.
Teams running Cervantes v1.3-beta, which is a penetration testing tool with multiple projects, may be affected. The sources do not say which deployment modes or roles are exposed, or whether authentication is required. unknown
No product ranges from the sources yet.
v1.3-betaUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.
This page as .md · .json · in your agent: get_signal("CVE-2026-115994")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.