{"schema":"threatline.record/2","record":{"id":"CVE-2026-115994","aliases":[],"summary":"BOLA Allows Cross-Project Target Tampering","details":"BOLA Allows Cross-Project Target Tampering \nin Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.","categories":["Unclassified"],"product":"cervantes","vendor":"CervantesSec","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115994","source_modified_at":"2026-10-24T09:04:02.750Z","fetched_at":"2026-10-24T10:48:42.330819Z","product":"cervantes","vendor":"CervantesSec","versions":[{"lessThanOrEqual":"1.3-beta","status":"affected","version":"alpha 0.3","versionType":"custom"},{"status":"unaffected","version":"v.1.4.0-beta"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":5.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00298,"percentile":0.21438,"score_date":"2026-10-24"},"published_at":"2026-10-24T09:04:02.750Z","modified_at":"2026-10-24T09:04:02.750Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-115994","fetched_at":"2026-10-24T10:48:42.330819Z","source_modified_at":"2026-10-24T09:04:02.750Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115994","fetched_at":"2026-10-24T18:03:20.872036Z","source_modified_at":"2026-10-24"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.grayback.es/advisories","tags":["patch"]},{"source":"CVE List","url":"https://www.grayback.es/en/advisories","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-24T09:04:02.750Z","content_hash":"daeeb44515a1dab140ae33931c6d942ff08683e29cc7f336d539128865f4f521"}}