CVE-2026-115998

cervantes: IDOR: User reads and modifies findings from other people's projects

CervantesSec cervantes

CVSS

4.3Medium

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 24 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version. Check the vendor advisory below

Published24 Oct 2026Updated 24 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

24 Oct 2026, 09:28 UTCPublishedCVE List
24 Oct 2026, 10:20 UTCExploit code publicTelegram: CVE Notify

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

🚨 CVE-2026-115998 IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects thTelegram: CVE Notify, 24 Oct 2026Exploit code

Description

IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.

Text from CVE List

Affected versions 2

cervantesaffected: alpha 0.3 through 1.3-betaCVE List
cervantesunaffected: v.1.4.0-betaCVE List