CVE-2026-115994

Full vulnerability record from the local CVENow database.

Description

BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.

Severity

MEDIUM

CVSS score

5.4 (v3.1)

Vulnerability status

Deferred

Source identifier

772f0079-75c2-41ca-913e-d9072716578b

Published

2026-10-24 10:17:10.600000

Last modified

2026-10-26 14:20:46.557000

View original CVE JSON

{
  "id": "CVE-2026-115994",
  "sourceIdentifier": "772f0079-75c2-41ca-913e-d9072716578b",
  "published": "2026-10-24T10:17:10.600",
  "lastModified": "2026-10-26T14:20:46.557",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "BOLA Allows Cross-Project Target Tampering \nin Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports."
    }
  ],
  "affected": [
    {
      "source": "772f0079-75c2-41ca-913e-d9072716578b",
      "affectedData": [
        {
          "vendor": "CervantesSec",
          "product": "cervantes",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "alpha 0.3",
              "lessThanOrEqual": "1.3-beta",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "v.1.4.0-beta",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "772f0079-75c2-41ca-913e-d9072716578b",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ]
  },
  "weaknesses": [
    {
      "source": "772f0079-75c2-41ca-913e-d9072716578b",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.grayback.es/advisories",
      "source": "772f0079-75c2-41ca-913e-d9072716578b"
    },
    {
      "url": "https://www.grayback.es/en/advisories",
      "source": "772f0079-75c2-41ca-913e-d9072716578b"
    }
  ]
}