CVE-2026-115994 PUBLISHED

BOLA Allows Cross-Project Target Tampering

Assigner: Grayback
Reserved: 24.10.2026 Published: 24.10.2026 Updated: 24.10.2026

BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS Score: 5.4

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	Low
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	CervantesSec
Product	cervantes
Versions	Default: unaffected affected from alpha 0.3 to 1.3-beta (incl.) Version v.1.4.0-beta is unaffected

Solutions

This vulnerability has been patched in version 1.4.0-beta of Cervantes

Credits

Jaime Ramírez finder

References

Problem Types

CWE-639 - Authorization Bypass Through User-Controlled Key CWE