CVE-2026-115975
cervantes: Broken access control in JiraController
CervantesSec cervantes
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 24 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Reports 2
2 outlets mention it. Reports are not confirmation; each links to its source.
- @cve.skyfleet.blue: CVE-2026-115975 - Broken access control in JiraController CVE ID : CVE-2026-115975 Published : Oct. 24, 2026, 7:39 a.m. | 20 minutes ago Description : Broken access control in JiraBluesky: CVE posts, 24 Oct 2026
- 🚨 CVE-2026-115975 Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects 🎖 @cveNotTelegram: CVE Notify, 24 Oct 2026
Description
Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects
Text from CVE List
Affected versions 2
- cervantesaffected: alpha 0.3 through 1.3-betaCVE List
- cervantesunaffected: v.1.4.0-betaCVE List