---
id: "CVE-2026-115998"
kind: "vulnerability"
aliases: ["CVE-2026-115998"]
title: "Cervantes: IDOR lets authenticated users read and alter other projects' findings"
severity: "medium"
cvss: 4.3
epss: 0.00264
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["cervantes", "other", "pentest-reporting", "self-hosted"]
not_affected_if: ["no-other-tenants", "single-user-instance"]
published_at: "2026-10-24T10:17:10+00:00"
first_seen_at: "2026-10-24T10:47:22+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115998", "first_seen_at": "2026-10-24T10:47:22+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-115998", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Cervantes: IDOR lets authenticated users read and alter other projects' findings

Cervantes v1.3-beta has an insecure direct object reference that lets a logged-in user access findings, proof-of-concept details, credentials and client data from projects they do not belong to. The same flaw lets them change finding statuses and move findings into their own projects.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed version is `v1.3-beta` or check the project's release tag
- unknown for any further check; the sources do not name a file, endpoint or setting to inspect

## Fix

- unknown; the sources do not name a fixed version or a patch
- Until a fix is confirmed, restrict access to the Cervantes instance to trusted users

## Timeline

- 2026-10-24T10:47:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115998
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-115998

## From the sources

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_