Cervantes: Broken access control in JiraController (CVE-2026-115975)
Cervantes version v1.3-beta contains a broken access control vulnerability in the JiraController component allowing unauthorized manipulation of Jira tickets across projects.
CVE search metadata
CVE search record: CVE-2026-115975. Severity: high. CVSS: 7.1. KEV: no. Product: Cervantes (v1.3-beta). Brief: Cervantes: Broken access control in JiraController (CVE-2026-115975). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cervantes-jira-access-control/
Triage facts
Revision 1- Applicability
- Cervantes (v1.3-beta)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 24, 10:12 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Cervantes version v1.3-beta is affected by a broken access control vulnerability in the JiraController component, tracked as CVE-2026-115975. This flaw permits an authenticated user to perform unauthorized actions including creating, editing, or deleting Jira tickets related to vulnerabilities in projects outside their assigned scope.
Impact
Successful exploitation allows unauthorized modification of project data, which can compromise the integrity of vulnerability management workflows and lead to project-wide interference.
Recommendation
Inventory all instances of Cervantes v1.3-beta within the environment. If identified, restrict access to the JiraController component or upgrade to a patched version once provided by the vendor.
Immediate actions
Identify all instances of Cervantes v1.3-beta in the environment
Threat Hunt
Monitor for suspicious Jira ticket modification activity originating from the Cervantes application service account
Data: Jira audit logs (ticket creation/modification), Cervantes application logs
Mitigations
Upgrade to a patched version of Cervantes once released by the vendor
CVE-2026-115975