{"id":"CVE-2026-115998","kind":"vulnerability","aliases":["CVE-2026-115998"],"related":[],"title":"Cervantes: IDOR lets authenticated users read and alter other projects' findings","description":"IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.","summary":"Cervantes v1.3-beta has an insecure direct object reference that lets a logged-in user access findings, proof-of-concept details, credentials and client data from projects they do not belong to. The same flaw lets them change finding statuses and move findings into their own projects.","severity":"medium","cvss":4.3,"epss":0.00264,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cervantes","other","pentest-reporting","self-hosted"],"not_affected_if":["no-other-tenants","single-user-instance"],"how_to_check":"- Confirm the installed version is `v1.3-beta` or check the project's release tag\n- unknown for any further check; the sources do not name a file, endpoint or setting to inspect","fix":"- unknown; the sources do not name a fixed version or a patch\n- Until a fix is confirmed, restrict access to the Cervantes instance to trusted users","status":"open","published_at":"2026-10-24T10:17:10+00:00","first_seen_at":"2026-10-24T10:47:22+00:00","triaged_at":"2026-10-25T04:37:13+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:37:13Z","model":"claude-haiku-5-5","output":{"fix":"- unknown; the sources do not name a fixed version or a patch\n- Until a fix is confirmed, restrict access to the Cervantes instance to trusted users","reach":"internet","title":"Cervantes: IDOR lets authenticated users read and alter other projects' findings","impact":"high","summary":"Cervantes v1.3-beta has an insecure direct object reference that lets a logged-in user access findings, proof-of-concept details, credentials and client data from projects they do not belong to. The same flaw lets them change finding statuses and move findings into their own projects.","category":"other","nicknames":[],"who_cares":["cervantes","self-hosted","pentest-reporting"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated attacker reads and changes other projects' findings and credentials","analyst_note":"Confirm the fixed version and whether the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115998 or the upstream repo lists one.","how_to_check":"- Confirm the installed version is `v1.3-beta` or check the project's release tag\n- unknown for any further check; the sources do not name a file, endpoint or setting to inspect","needs_analyst":true,"not_affected_if":["single-user-instance","no-other-tenants"],"who_is_affected":"Teams running Cervantes v1.3-beta where more than one authenticated user or client shares the same instance. Single-user or fully trusted-user deployments carry less risk. The sources do not describe the exact configuration needed for exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000617,"input_tokens":3325,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115998':14A,17A '-2026':13A,16A 'access':41B,85C 'addit':104C 'allow':80C 'alter':8A 'attack':83C 'authent':4A,82C 'belong':57B,102C 'ca':84C 'cervant':1A,18B,26B,76C 'chang':64B 'client':50B,95C 'compromis':117C 'concept':46B,91C 'confidenti':119C 'could':79C 'credenti':48B,93C 'cve':12A,15A 'data':51B,118C 'detail':47B,92C 'direct':31B 'find':11A,42B,65B,69B,87C,108C,112C 'flaw':61B 'host':25B 'idor':2A,74C 'inform':96C 'insecur':30B 'integr':121C 'let':3A,35B,62B 'log':38B 'logged-in':37B 'modifi':107C 'move':68B 'object':32B 'pentest':21B 'pentest-report':20B 'project':10A,53B,73B,98C,116C 'proof':44B,89C 'proof-of-concept':43B,88C 'read':6A 'refer':33B 'report':22B 'self':24B 'self-host':23B 'sensit':86C 'status':66B,109C 'transfer':111C 'user':5A,40B 'v1.3-beta':27B,78C 'version':77C","nicknames":[],"mitigations":[],"who_affected":"Teams running Cervantes v1.3-beta where more than one authenticated user or client shares the same instance. Single-user or fully trusted-user deployments carry less risk. The sources do not describe the exact configuration needed for exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T10:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"772f0079-75c2-41ca-913e-d9072716578b","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115998","severity":null,"published_at":"2026-10-24T10:17:10+00:00","modified_at":"2026-10-24T10:17:10+00:00","first_seen_at":"2026-10-24T10:47:22+00:00","fetched_at":"2026-10-24T10:47:22+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115998","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115998","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}