Cervantes EUVD-2026-109260

Requires a valid authenticated account on the target Cervantes v1.3-beta instance (CVSS PR:L) that hosts more than one project; the attacker then supplies an object identifier referencing a target belonging to a project they do not own. Exploitation is limited by that authentication requirement and by the multi-project/multi-tenant deployment assumption - a single-user or single-project instance offers no cross-project targets to tamper with. No user interaction is needed (UI:N) and the request is network-reachable (AV:N). Impact is restricted to integrity and availability of target records (modify/delete); no confidentiality disclosure is described.

This is a moderate-priority issue, not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4) describes a network-reachable, low-complexity flaw that nonetheless requires an authenticated low-privileged account (PR:L) and yields only partial integrity and availability impact with no confidentiality loss. The vuln.today decision label is 'this_month', consistent with a real but non-critical fix timeline. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no proof-of-concept or exploit reference is present (the two references are vendor advisory/patch pages only), so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is bounded by the authentication requirement and by the nature of the target: Cervantes is a pentest-management platform typically used by small security teams, so exploitation implies a malicious or compromised insider on a multi-project instance rather than internet-wide opportunistic abuse. One caveat: the input Tags label this 'Authentication Bypass', but the description and CWE-639 describe a broken-object-level-authorization (authorization) flaw affecting an already-authenticated user - these are distinct and the tag overstates the access gained.

A low-privileged but authenticated user of a shared Cervantes v1.3-beta instance manipulates the object identifier in a target-related request to reference targets owned by a project they are not a member of, then modifies or deletes those targets. Because no confidentiality boundary is broken but integrity and availability are, the attacker corrupts or erases another team's engagement scope and findings. No public exploit code or PoC reference is available at time of analysis.