CVE-2026-115994: BOLA Allows Cross-Project Target Tampering

Published Oct 24, 2026

Updated

BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.

Affected Software

1 affected component

Cervantes Cervantes=v1.3-beta

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Cervantes to a version that resolves this vulnerability.
Fixed in 1.4.0-beta

Event History

Oct 24, 2026

CVE Published

via MITRE·09:04 AM

Data Sourced

via MITRE·09:04 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs low-level privileges in Cervantes and network access to the affected application. No user interaction is required.

What actions could an attacker perform across project boundaries?

The attacker could modify or delete targets that belong to other projects without authorization. This can compromise penetration-testing scopes, results, and associated security reports.

What security impact is indicated?

The issue affects integrity and availability, with no confidentiality impact indicated. Its CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.