CVE-2026-115994

BOLA Allows Cross-Project Target Tampering

Published Oct 24, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Description

BOLA Allows Cross-Project Target Tampering
in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.

Analysis

Technical impact

The vulnerability is a broken access control (BOLA) that allows an attacker to modify or delete targets belonging to other projects without requiring authentication. This directly compromises the integrity of penetration testing scopes, results, and related security reports. The weakness is categorized as CWE-639, representing insufficient authorization checks.

Affected Systems

The affected product is Cervantes by CervantesSec. Versions v1.3-beta and earlier are susceptible. The vendor has released a patch in version 1.4.0-beta that eliminates the flaw.

Risk and Exploitability

The overall severity is a CVSS score of 5.4, indicating moderate risk. No EPSS score is available and the vulnerability is not listed in CISA's KEV catalog. Attackers could exploit the flaw without requiring authentication, potentially targeting other projects by using the application UI or API. The lack of evidence of active exploitation means no known public exploits, but the potential for integrity compromise makes it a serious concern.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

CervantesSec

cervantes

unaffected

Version	Status	Constraints
`alpha 0.3`	affected	≤ 1.3-beta
`v.1.4.0-beta`	unaffected	—

No data.

Vendor Product Versions

Cervantessec

Cervantes

Version	Status	Scheme	Platform
`[alpha 0.3,1.3-beta]`	affected	generic	—
`v.1.4.0-beta`	unaffected	generic	—

Remediation

Vendor Solution

This vulnerability has been patched in version 1.4.0-beta of Cervantes

OpenCVE Recommended Actions

Upgrade Cervantes to version 1.4.0-beta or later to apply the vendor patch.
If an upgrade is delayed, enforce stricter role‑based access control so that users can only manage targets within their own project.
Audit and monitor logs for cross‑project target modifications and report suspicious events to the security team.
Verify that the authorization controls do not allow cross-project edits by performing post‑configuration penetration testing or internal validation.

Generated by OpenCVE AI on October 24, 2026 at 10:50 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.221% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.grayback.es/advisories
https://www.grayback.es/en/advisories

History

Nov 2, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 24, 2026 9:30 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.
Title		BOLA Allows Cross-Project Target Tampering
First Time appeared		Cervantessec Cervantessec cervantes
Weaknesses		CWE-639
CPEs		cpe:2.3:a:cervantessec:cervantes:::::::: cpe:2.3:a:cervantessec:cervantes:v.1.4.0-beta:::::::*
Vendors & Products		Cervantessec Cervantessec cervantes
References		https://www.grayback.es/advisories https://www.grayback.es/en/advisories
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}`