CVE-2026-115994: CWE-639 - Authorization Bypass Through User-Controlled Key in CervantesSec cervantes

This vulnerability (CVE-2026-115994) in CervantesSec cervantes v1.3-beta involves Broken Object Level Authorization (BOLA) that permits an attacker to tamper with targets across different projects. Specifically, an attacker can modify or delete targets that do not belong to their authorized project, thereby affecting the accuracy and trustworthiness of penetration testing data and reports. The CVSS 3.1 base score is 5.4, indicating a medium severity with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

An attacker with some level of privileges can bypass authorization controls to alter or remove targets in projects they do not own. This undermines the integrity of penetration testing scopes and results, potentially leading to inaccurate security assessments and reports. There is no direct confidentiality impact, but integrity and availability are affected to a limited degree.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user privileges carefully and monitor for unauthorized modifications to project targets.