{"id":"CVE-2026-115994","kind":"vulnerability","aliases":["CVE-2026-115994"],"related":[],"title":"Cervantes: flaw lets users modify or delete other projects' targets","description":"BOLA Allows Cross-Project Target Tampering \nin Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.","summary":"Cervantes v1.3-beta has a broken object-level authorization flaw (BOLA) that lets an attacker change or delete targets belonging to other projects. The sources say this can compromise penetration testing scopes, results and security reports.","severity":"medium","cvss":5.4,"epss":0.00298,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cervantes","other","penetration-testing"],"not_affected_if":[],"how_to_check":"- Check the installed Cervantes version against `v1.3-beta`\n- unknown","fix":null,"status":"open","published_at":"2026-10-24T10:17:10+00:00","first_seen_at":"2026-10-24T10:47:22+00:00","triaged_at":"2026-10-25T04:14:10+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-25T04:14:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Cervantes: flaw lets users modify or delete other projects' targets","impact":"medium","summary":"Cervantes v1.3-beta has a broken object-level authorization flaw (BOLA) that lets an attacker change or delete targets belonging to other projects. The sources say this can compromise penetration testing scopes, results and security reports.","category":"other","nicknames":[],"who_cares":["cervantes","penetration-testing"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Attacker alters or deletes other projects' targets and reports","analyst_note":"Confirm the affected Cervantes versions, whether a fixed release exists, and whether login is required; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115994.","how_to_check":"- Check the installed Cervantes version against `v1.3-beta`\n- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running Cervantes v1.3-beta, which is a penetration testing tool with multiple projects, may be affected. The sources do not say which deployment modes or roles are exposed, or whether authentication is required. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000562,"input_tokens":3313,"output_tokens":462,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115994':13A,16A '-2026':12A,15A 'allow':59C,70C 'associ':92C 'attack':36B,72C 'author':30B,82C 'belong':41B,77C 'bola':32B,58C 'broken':26B 'cervant':1A,17B,22B,66C 'chang':37B 'compromis':50B,83C 'could':69C 'cross':61C 'cross-project':60C 'cve':11A,14A 'delet':7A,39B,75C 'flaw':2A,31B 'integr':85C 'let':3A,34B 'level':29B 'modifi':5A,73C 'object':28B 'object-level':27B 'penetr':20B,51B,87C 'penetration-test':19B 'project':9A,44B,62C,80C 'report':57B,94C 'result':54B,90C 'say':47B 'scope':53B,89C 'secur':56B,93C 'sourc':46B 'tamper':64C 'target':10A,40B,63C,76C 'test':21B,52B,88C 'user':4A 'v1.3-beta':23B,68C 'version':67C 'without':81C","nicknames":[],"mitigations":[],"who_affected":"Teams running Cervantes v1.3-beta, which is a penetration testing tool with multiple projects, may be affected. The sources do not say which deployment modes or roles are exposed, or whether authentication is required. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T10:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvss_by":"772f0079-75c2-41ca-913e-d9072716578b","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115994","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115994","severity":null,"published_at":"2026-10-24T10:17:10+00:00","modified_at":"2026-10-24T10:17:10+00:00","first_seen_at":"2026-10-24T10:47:22+00:00","fetched_at":"2026-10-24T10:47:22+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115994","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115994","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}