Public vulnerability disclosure

CVE-2026-115975

Broken access control in JiraController

publishedCWE-862

Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects

Investigate in Cyber JSON Markdown

Technical severity7.1 highCVSS 3.1 · CNA: Grayback

Published2026-10-24Source updated 2026-11-02

Collected2026-11-022 attributed sources

Fixes and workarounds

Fix

This vulnerability has been patched in version 1.4.0-beta of Cervantes

Source: CNA: Grayback

Affected products and versions

Affected products, source version ranges and reporting authorities
Product	Versions	Authority
cervantes CervantesSec	≥ alpha 0.3; ≤ 1.3-beta (affected, custom) v.1.4.0-beta (unaffected) Other versions: unaffected	CNA: Grayback

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
3.1 / 7.1 high	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N`	CNA: Grayback

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References

https://www.grayback.es/advisoriesCNA: Grayback · patch
https://www.grayback.es/en/advisoriesCNA: Grayback · patch