Unauthorized Access Vulnerability in Cervantes by Grayback
CVE-2026-115994

5.4MEDIUM

Key Information:

Vendor

Cervantessec

Status
Cervantes
Vendor
CVE Published:
24 October 2026

What is CVE-2026-115994?

The vulnerability in Cervantes version v1.3-beta allows attackers to manipulate or delete targets belonging to other projects without proper authorization. This severe issue jeopardizes the integrity of penetration testing scopes, results, and accompanying security reports, potentially leading to significant security compromises for organizations utilizing this tool.

Affected Version(s)

cervantes alpha 0.3 <= 1.3-beta

cervantes v.1.4.0-beta

References

https://www.grayback.es/advisories
patch
https://www.grayback.es/en/advisories
patch

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jaime RamĂ­rez
.