CVE-2026-115998: CWE-639: Authorization Bypass Through User-Controlled Key in CervantesSec cervantes
Description
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.
CVSS v3.1
4.3medium
Affected software
CervantesSec
cervantes
Weaknesses
Technical Details
- Assigned by
- Grayback
- Reserved
- 10/24/2026
- CVSS version
- 3.1
Threat ID: 6adc7d321c4d71e8e9051a78
Added to database: 10/24/2026, 09:41:06 UTC
Last updated: 10/24/2026, 09:41:06 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.