CVE-2026-115975: CWE-862: Missing Authorization in CervantesSec cervantes

The vulnerability identified as CVE-2026-115975 in CervantesSec's cervantes product (version v1.3-beta) involves missing authorization checks in the JiraController. This broken access control issue permits an attacker with limited privileges (PR:L) to perform unauthorized actions such as creating, editing, or deleting Jira tickets for vulnerabilities in other projects. The CVSS 3.1 vector indicates network attack vector (AV:N), low attack complexity (AC:L), no user interaction (UI:N), unchanged scope (S:U), low confidentiality impact (C:L), high integrity impact (I:H), and no availability impact (A:N).

An attacker with some level of privileges can manipulate Jira tickets across projects without proper authorization, potentially leading to unauthorized modification or deletion of vulnerability tracking information. This could undermine the integrity of vulnerability management processes within affected environments.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the JiraController functionality to trusted users only and monitor for unauthorized ticket modifications.