in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CervantesSec | cervantes | unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
This vulnerability has been patched in version 1.4.0-beta of Cervantes
Tracking
Sign in to view the affected projects.
No advisories yet.
Sat, 24 Oct 2026 09:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports. | |
| Title | BOLA Allows Cross-Project Target Tampering | |
| First Time appeared |
Cervantessec
Cervantessec cervantes |
|
| Weaknesses | CWE-639 | |
| CPEs | cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:* cpe:2.3:a:cervantessec:cervantes:v.1.4.0-beta:*:*:*:*:*:*:* |
|
| Vendors & Products |
Cervantessec
Cervantessec cervantes |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Grayback
Published:
Updated: 2026-10-24T09:04:02.750Z
Reserved: 2026-10-24T08:56:03.942Z
Link: CVE-2026-115994
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-24T10:17:10.600
Modified: 2026-10-24T10:17:10.600
Link: CVE-2026-115994
Redhat
No data.
OpenCVE Enrichment
No data.