{"id":"CVE-2026-129427","kind":"vulnerability","aliases":["CVE-2026-129427"],"related":[],"title":"Cervantes: avatar upload XSS plus auth bypass takes over accounts","description":"Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO\nin Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges","summary":"Cervantes v1.3-beta has a stored cross-site scripting flaw in avatar uploads, chained with an authentication bypass in the /Attachments path. An attacker can run script in another user's browser with that user's elevated privileges, leading to account takeover.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"cervantes","fixed":[],"affected":"v1.3-beta","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-bypass","cervantes","other","self-hosted","xss"],"not_affected_if":[],"how_to_check":"Check the deployed Cervantes version (v1.3-beta is the only version named as affected). Also check earlier versions if you run them: not confirmed either way. Check whether untrusted users can reach the instance and upload avatars.","fix":"Unknown for this CVE. The vendor's v1.4.0-beta release notes describe hardening of avatar uploads (images only), attachment serving and CSP, but do not name this CVE. Upgrading to v1.4.0-beta or later is a reasonable step; not confirmed as the fix.","status":"open","published_at":"2026-11-14T12:17:44+00:00","first_seen_at":"2026-11-14T12:28:31+00:00","triaged_at":"2026-11-14T12:30:27+00:00","updated_at":"2026-11-14T12:31:38+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-14T12:30:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Cervantes: avatar upload XSS plus auth bypass takes over accounts","impact":"high","summary":"Cervantes v1.3-beta has a stored cross-site scripting flaw in avatar uploads, chained with an authentication bypass in the /Attachments path. An attacker can run script in another user's browser with that user's elevated privileges, leading to account takeover.","audience":"businesses","category":"other","nicknames":[],"who_cares":["cervantes"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker takes over admin accounts via injected script","analyst_note":"Confirm the affected product and vendor, the fixed version and whether the /Attachments bypass needs an account, using the NVD entry and the project's repository.","how_to_check":"- Check whether the installed Cervantes version is `v1.3-beta`\n- Check whether the application is reachable from the internet and allows avatar uploads","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":4535,"output_tokens":421,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected product and vendor, the fixed version and whether the /Attachments bypass needs an account, using the NVD entry and the project's repository.","search":"'-129427':13A,16A '-2026':12A,15A '/attachments':47B,80C 'account':10A,67B 'allow':89C 'anoth':55B,97C 'arbitrari':94C 'ato':83C 'attack':50B,91C 'auth':6A,19B 'auth-bypass':18B 'authent':43B,77C 'avatar':2A,38B,72C 'browser':58B,100C 'bypass':7A,20B,44B,78C 'cervant':1A,21B,27B,85C 'cervantes':17A 'chain':40B,74C 'code':95C 'could':88C 'cross':33B 'cross-sit':32B 'cve':11A,14A 'elev':63B,102C 'execut':93C 'flaw':36B 'host':25B 'lead':65B,81C 'path':48B 'plus':5A 'privileg':64B,103C 'run':52B 'script':35B,53B 'self':24B 'self-host':23B 'site':34B 'store':31B,69C 'take':8A 'takeov':68B 'upload':3A,39B,73C 'user':56B,61B,98C 'v1.3-beta':28B,87C 'version':86C 'via':71C 'xss':4A,26B,70C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host CervantesSec Cervantes v1.3-beta, a pentest/vulnerability management app. A user who can upload an avatar can store script that runs in another user's browser, combined with an auth bypass on the /Attachments path, leading to account takeover. Teams not running Cervantes, or with it reachable only by trusted users, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["cervantes"],"ptokens":["cervantes"],"labels":["authbypass","cervantes","high","other","selfhosted","xss"],"campaign_type":null,"search_a":"'-129427':13A,16A '-2026':12A,15A 'account':10A 'auth':6A 'avatar':2A 'bypass':7A 'cervant':1A 'cervantes':17A 'cve':11A,14A 'plus':5A 'take':8A 'upload':3A 'xss':4A","search_b":"'/attachments':47B 'account':67B 'anoth':55B 'attack':50B 'auth':19B 'auth-bypass':18B 'authent':43B 'avatar':38B 'browser':58B 'bypass':20B,44B 'cervant':21B,27B 'chain':40B 'cross':33B 'cross-sit':32B 'elev':63B 'flaw':36B 'host':25B 'lead':65B 'path':48B 'privileg':64B 'run':52B 'script':35B,53B 'self':24B 'self-host':23B 'site':34B 'store':31B 'takeov':68B 'upload':39B 'user':56B,61B 'v1.3-beta':28B 'xss':26B","search_c":"'/attachments':80C 'allow':89C 'anoth':97C 'arbitrari':94C 'ato':83C 'attack':91C 'authent':77C 'avatar':72C 'browser':100C 'bypass':78C 'cervant':85C 'chain':74C 'code':95C 'could':88C 'elev':102C 'execut':93C 'lead':81C 'privileg':103C 'store':69C 'upload':73C 'user':98C 'v1.3-beta':87C 'version':86C 'via':71C 'xss':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T12:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","cvss_by":"772f0079-75c2-41ca-913e-d9072716578b","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129427","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129427","severity":null,"published_at":"2026-11-14T12:17:44+00:00","modified_at":"2026-11-14T12:17:44+00:00","first_seen_at":"2026-11-14T12:28:31+00:00","fetched_at":"2026-11-14T12:28:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129427:3978","url":"https://github.com/CervantesSec/cervantes/releases","severity":null,"published_at":"2026-11-14T12:31:38+00:00","modified_at":"2026-11-14T12:31:38+00:00","first_seen_at":"2026-11-14T12:31:38+00:00","fetched_at":"2026-11-14T12:31:38+00:00","note":"NVD/Rapid7: CervantesSec cervantes v1.3-beta, CVSS PR:L suggests an account is needed, though the description says auth bypass in /Attachments (unclear). No vendor advisory or CVE-specific fix found. v1.4.0-beta release notes (23 Oct) describe avatar images-only, attachments served by app endpoint with sandbox, SVG/XHTML refused, enforced CSP; plausibly the fix but not stated for this CVE.","cites":["https://github.com/CervantesSec/cervantes/releases","https://www.rapid7.com/db/vulnerabilities/cve-2026-129427/"]}],"documents":[{"id":155486,"url":"https://github.com/CervantesSec/cervantes/releases","title":"CervantesSec/cervantes releases (v1.3-beta, v1.4.0-beta)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":155487,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-129427/","title":"Rapid7 DB: CVE-2026-129427","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}