CVE-2026-115998

IDOR: User reads and modifies findings from other people's projects

Published Oct 24, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.

Analysis

Technical impact

The vulnerability is an IDOR flaw in Cervantes that lets an authenticated attacker read technical evidence, credentials, and client details from projects they are not a part of. This flaw is categorized as CWE‑639, Information Exposure Through IDOR. The flaw also allows the attacker to change finding statuses and move findings into projects they own, thereby corrupting data integrity. Affected data includes sensitive findings and proof‑of‑concept artifacts.

Affected Systems

The issue affects Cervantes by CervantesSec, specifically the v1.3‑beta release and the subsequent v1.4.0‑beta version mentioned in the product list. Any installation of these versions is vulnerable.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate severity level, and no EPSS value is available. The vulnerability is not listed in the CISA KEV catalog. Attackers seemingly need to be authenticated users with sufficient privileges; it is therefore expected that exploitation requires prior access to the system. While the scoring reflects moderate risk, the potential damage from altered findings and exposed credentials could be significant.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

CervantesSec

cervantes

unaffected

Version	Status	Constraints
`alpha 0.3`	affected	≤ 1.3-beta
`v.1.4.0-beta`	unaffected	—

No data.

Vendor Product Versions

Cervantessec

Cervantes

Version	Status	Scheme	Platform
`[alpha 0.3,1.3-beta]`	affected	generic	—
`v.1.4.0-beta`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to the latest Cervantes release that addresses the IDOR flaw.
Restrict authenticated users to only projects they own or are explicitly granted access to.
Audit and revoke any credentials or client data that may have been exposed through unauthorized project access.

Generated by OpenCVE AI on October 24, 2026 at 11:20 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.198% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.grayback.es/advisories
https://www.grayback.es/en/advisories

History

Nov 2, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 24, 2026 9:45 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.
Title		IDOR: User reads and modifies findings from other people's projects
First Time appeared		Cervantessec Cervantessec cervantes
Weaknesses		CWE-639
CPEs		cpe:2.3:a:cervantessec:cervantes:::::::: cpe:2.3:a:cervantessec:cervantes:v.1.4.0-beta:::::::*
Vendors & Products		Cervantessec Cervantessec cervantes
References		https://www.grayback.es/advisories https://www.grayback.es/en/advisories
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`