CVE-2026-129427: Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO

Published Nov 14, 2026

Updated

Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges

Affected Software

1 affected component

Cervantes Cervantes=v1.3-beta

Event History

Nov 14, 2026

CVE Published

via MITRE·11:19 AM

Data Sourced

via MITRE·11:19 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to initiate this attack?

The vector indicates that the attacker needs low-level privileges (PR:L) and must cause another user to interact with the stored payload (UI:R).

Who is most at risk from a successful exploit?

A user who views or otherwise interacts with the malicious stored avatar content is at risk. The issue can execute code in that user's browser with elevated privileges and may lead to account takeover.

Is this limited to a particular deployment or release?

The provided information identifies Cervantes version v1.3-beta as affected. No information is provided about other versions or configurations.

CVE-2026-129427: Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to initiate this attack?

Who is most at risk from a successful exploit?

Is this limited to a particular deployment or release?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to initiate this attack?

Who is most at risk from a successful exploit?

Is this limited to a particular deployment or release?