CVE-2026-115975: Broken access control in JiraController
Published Oct 24, 2026
·Updated
Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects
Affected Software
1 affected component
Cervantes Cervantes=v1.3-beta
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cervantesto a version that resolves this vulnerability.Fixed in 1.4.0-beta
Event History
Oct 24, 2026
CVE Published
via MITRE·07:39 AM
Data Sourced
via MITRE·07:39 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs low-level privileges and network access to the affected Cervantes instance. The issue enables actions against Jira tickets associated with vulnerabilities in other projects.
2
What actions could an attacker perform?
An attacker could create, edit, or delete Jira tickets for vulnerabilities belonging to other projects.
3
Which version is identified as affected?
The affected version identified in the available information is Cervantes v1.3-beta.