BOLA Allows Cross-Project Target Tampering
in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.
in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CervantesSec | cervantes | unaffected |
|
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
This vulnerability has been patched in version 1.4.0-beta of Cervantes
Workaround
No workaround given by the vendor.
References
History
Sat, 24 Oct 2026 09:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports. | |
| Title | BOLA Allows Cross-Project Target Tampering | |
| First Time appeared |
Cervantessec
Cervantessec cervantes |
|
| Weaknesses | CWE-639 | |
| CPEs | cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:* cpe:2.3:a:cervantessec:cervantes:v.1.4.0-beta:*:*:*:*:*:*:* |
|
| Vendors & Products |
Cervantessec
Cervantessec cervantes |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Grayback
Published:
Updated: 2026-10-24T09:04:02.750Z
Reserved: 2026-10-24T08:56:03.942Z
Link: CVE-2026-115994
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses