Cervantes CVE-2026-115998

Requires a valid authenticated account on the target Cervantes instance (CVSS PR:L - any low-privileged registered user suffices); the attack is performed over the network against the web application with no user interaction. Realistic impact requires a multi-tenant/multi-project deployment where the attacker's account and the victim projects coexist on the same instance, since the flaw is abuse of references to projects the attacker does not belong to. Limiting factors: an authenticated foothold is mandatory (not remote-unauthenticated), impact is confined to data accessible within that Cervantes instance, and affected versions are Cervantes alpha 0.3 through v1.3-beta. The exact parameter or identifier manipulated is not described in the available sources.

The supplied CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating a network-reachable, low-complexity flaw requiring low-privileged authentication, no user interaction, and only a low integrity impact with no confidentiality or availability impact. This vector is in direct tension with the description, which explicitly states the attacker can 'access sensitive findings, proof-of-concept details, credentials, and client information' - i.e. a clear confidentiality breach that the official vector scores as C:N. Treat this as a conflict: the published vector appears to understate confidentiality impact, so the real severity is likely higher than 4.3. No EPSS probability is provided, the CVE is not on CISA KEV, and no PoC/exploit reference is supplied - only vendor patch advisories. The vuln.today decision label is 'this_month' (a patch-within-the-month priority, not an emergency), which is consistent with the absence of active-exploitation and PoC signals. Net: this is a credible access-control weakness worth patching on a normal cycle rather than an emergency, and its real-world priority is further tempered by the niche deployment footprint of the affected product, not by low technical impact.

A low-privileged but authenticated user of a shared Cervantes instance manipulates object identifiers (e.g. project or finding IDs) in requests to reference projects they are not a member of, retrieving other teams' findings, PoC details, credentials, and client data. The same IDOR lets them change finding statuses and reassign findings into their own project. No public exploit code is identified at time of analysis, and the specific trigger is not detailed in the available sources beyond the IDOR/CWE-639 classification.