How do I check whether I am affected by CVE-2026-115998?

- Confirm the installed version is `v1.3-beta` or check the project's release tag - unknown for any further check; the sources do not name a file, endpoint or setting to inspect

What is the fix for CVE-2026-115998?

- unknown; the sources do not name a fixed version or a patch - Until a fix is confirmed, restrict access to the Cervantes instance to trusted users

Who is not affected by CVE-2026-115998?

Not affected if: no-other-tenants, single-user-instance.

Live › vulnerability › CVE-2026-115998

Go to dashboard

medium4.3Other

Cervantes: IDOR lets authenticated users read and alter other projects' findings

Cervantes v1.3-beta has an insecure direct object reference that lets a logged-in user access findings, proof-of-concept details, credentials and client data from projects they do not belong to. The same flaw lets them change finding statuses and move findings into their own projects.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

4.3

medium

scored by 772f0079-75c2-41ca-913e-d9072716578b

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 24, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-24 10:47 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Authenticated attacker reads and changes other projects' findings and credentials.
CVSS said: 4.3. The facts above say high; we keep the sources' medium until an analyst looks.

Who is affected

Teams running Cervantes v1.3-beta where more than one authenticated user or client shares the same instance. Single-user or fully trusted-user deployments carry less risk. The sources do not describe the exact configuration needed for exposure.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-115998

Go to dashboard

medium4.3Other

Cervantes: IDOR lets authenticated users read and alter other projects' findings

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

4.3

medium

scored by 772f0079-75c2-41ca-913e-d9072716578b

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 24, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-24 10:47 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Authenticated attacker reads and changes other projects' findings and credentials.
CVSS said: 4.3. The facts above say high; we keep the sources' medium until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Cervantes: IDOR lets authenticated users read and alter other projects' findings

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

Cervantes: IDOR lets authenticated users read and alter other projects' findings

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources