{"affected":[{"defaultStatus":"unaffected","product":"cervantes","source":"CNA: Grayback","vendor":"CervantesSec","versions":[{"lessThanOrEqual":"1.3-beta","status":"affected","version":"alpha 0.3","versionType":"custom"},{"status":"unaffected","version":"v.1.4.0-beta"}]}],"cveId":"CVE-2026-129427","cwes":["CWE-79"],"description":"Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO\nin Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: Grayback","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794655194038,"publishedAt":1794655194038,"references":[{"source":"CNA: Grayback","tags":["patch"],"url":"https://www.grayback.es/advisories"},{"source":"CNA: Grayback","tags":["patch"],"url":"https://www.grayback.es/en/advisories"}],"remediation":[{"kind":"fix","source":"CNA: Grayback","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.grayback.es/advisories"},{"kind":"fix","source":"CNA: Grayback","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.grayback.es/en/advisories"}],"revision":"f023a2b0fc5ec92289c934611bb4689e75efdf55787d388e7866ecf753174ec4","sources":[{"modifiedAt":1794655194038,"name":"CNA: Grayback","retrievedAt":1794658112964,"url":"https://www.cve.org/CVERecord?id=CVE-2026-129427"}],"ssvc":null,"status":"published","title":"Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO","updatedAt":1794658112964}