Vulnerability · Published Oct 24, 2026 · Assigned by Grayback
CVE-2026-115994BOLA Allows Cross-Project Target Tampering
Medium 5.4
In plain English
A medium-severity authorization bypass via user-controlled key in cervantes from CervantesSec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 87.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CervantesSec | cervantes | alpha 0.3 – through 1.3-beta |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L