CVE-2026-115998
IDOR: User reads and modifies findings from other people's projects
CVSS v3.1 (listed by NVD)
4.3
MEDIUM
Scored by Grayback (not yet scored by NVD)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
4.3
MEDIUM
Scored by CNA (Grayback) · v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS exploit probability
0.3%
Percentile 17.4%
as of 2026-10-24
CISA KEV
—
Not listed
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.1 vector
NetworkLoginNo interaction
Confidentiality NIntegrity LAvailability N
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Privileges required PR | L | Regular user |
| User interaction UI | N | None |
| Scope S | U | Unchanged |
| Confidentiality C | N | None |
| Integrity I | L | Low |
| Availability A | N | None |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Description
NVD
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / 772f0079-75c2-41ca-913e-d9072716578b (Secondary) | 3.1 | 4.3 MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CNA / Grayback | 3.1 | 4.3 MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| CervantesSec | cervantes | affected: alpha 0.3 … <= 1.3-beta unaffected: v.1.4.0-beta default: unaffected |
Linux distribution status
References (2)
- https://www.grayback.es/advisories NVD, CNA patch
- https://www.grayback.es/en/advisories NVD, CNA patch