CVE-2026-115994

Published: Oct 24, 2026Modified: Oct 26, 2026Deferred

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Exploitability: 2.8 / Impact: 2.5

Source: 772f0079-75c2-41ca-913e-d9072716578b (Secondary)

Description

BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://www.grayback.es/advisories

Source: 772f0079-75c2-41ca-913e-d9072716578b

https://www.grayback.es/en/advisories

Source: 772f0079-75c2-41ca-913e-d9072716578b

Timeline

No history available yet.