CVE-2026-115994
BOLA Allows Cross-Project Target Tampering
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS v3.1 (listed by NVD)
5.4
MEDIUM
Scored by Grayback (not yet scored by NVD)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
5.4
MEDIUM
Scored by CNA (Grayback) · v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS exploit probability
0.3%
Percentile 21.4%
as of 2026-10-24
CISA KEV
—
Not listed
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.1 vector
NetworkLoginNo interaction
Confidentiality NIntegrity LAvailability L
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Privileges required PR | L | Regular user |
| User interaction UI | N | None |
| Scope S | U | Unchanged |
| Confidentiality C | N | None |
| Integrity I | L | Low |
| Availability A | L | Low |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Description
NVD
BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.
Solutions (CNA)
This vulnerability has been patched in version 1.4.0-beta of Cervantes
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / 772f0079-75c2-41ca-913e-d9072716578b (Secondary) | 3.1 | 5.4 MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
| CNA / Grayback | 3.1 | 5.4 MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| CervantesSec | cervantes | affected: alpha 0.3 … <= 1.3-beta unaffected: v.1.4.0-beta default: unaffected |
Linux distribution status
References (2)
- https://www.grayback.es/advisories NVD, CNA patch
- https://www.grayback.es/en/advisories NVD, CNA patch