The vulnerability is a broken access control in the JiraController component of Cervantes, which allows an attacker to create, edit, or delete Jira tickets belonging to other projects. This can lead to incorrect tracking, loss of evidence, or denial of service for ticket visibility, thereby compromising the integrity of project management data. The weakness is classified as CWE-862.

The affected vendor is CervantesSec with the product Cervantes. Version v1.3-beta is vulnerable, while the issue is fixed in version 1.4.0-beta. CPE entries include all releases of Cervantes and the patched version 1.4.0-beta.

The CVSS base score of 7.1 indicates a high severity vulnerability. No EPSS value is available and the issue is not listed in the CISA KEV catalog, which suggests moderate to high exploit probability but limited publicly documented exploitation. Based on the description, the likely attack vector is through the web interface; an attacker would formulate HTTP requests to the JiraController endpoint and execute the unauthorized actions, with minimal prerequisites such as valid authentication or misconfigured permissions. Given the potential for data integrity loss and the high CVSS score, the risk to organizations using the vulnerable version should be considered significant.