IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CervantesSec | cervantes | unaffected |
|
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sat, 24 Oct 2026 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity. | |
| Title | IDOR: User reads and modifies findings from other people's projects | |
| First Time appeared |
Cervantessec
Cervantessec cervantes |
|
| Weaknesses | CWE-639 | |
| CPEs | cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:* cpe:2.3:a:cervantessec:cervantes:v.1.4.0-beta:*:*:*:*:*:*:* |
|
| Vendors & Products |
Cervantessec
Cervantessec cervantes |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Grayback
Published:
Updated: 2026-10-24T09:28:05.849Z
Reserved: 2026-10-24T09:23:13.297Z
Link: CVE-2026-115998
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses