Broken Access Control in Cervantes: JiraController Vulnerability
CVE-2026-115975

7.1HIGH

Key Information:

Vendor

Cervantessec

Status
Cervantes
Vendor
CVE Published:
24 October 2026

What is CVE-2026-115975?

The Cervantes product, specifically version v1.3-beta, is susceptible to a broken access control vulnerability in the JiraController component. This weakness can be exploited by malicious actors to create, modify, or delete Jira tickets related to vulnerabilities across various projects. The lack of proper access restrictions enables unauthorized users to manipulate critical project data, potentially leading to significant operational disruptions.

Affected Version(s)

cervantes alpha 0.3 <= 1.3-beta

cervantes v.1.4.0-beta

References

https://www.grayback.es/advisories
patch
https://www.grayback.es/en/advisories
patch

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Manuel Martinez Casasola
.