Cpe:2.3:a:cervantes:cervantes:1.3:beta:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3acervantescervantes1.3beta/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 10:12:51 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCervantes: Broken access control in JiraController (CVE-2026-115975)https://feed.craftedsignal.io/briefs/2026-10-cervantes-jira-access-control/Sat, 24 Oct 2026 10:12:51 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cervantes-jira-access-control/Cervantes version v1.3-beta contains a broken access control vulnerability in the JiraController component allowing unauthorized manipulation of Jira tickets across projects.Cervantes version v1.3-beta is affected by a broken access control vulnerability in the JiraController component, tracked as CVE-2026-115975. This flaw permits an authenticated user to perform unauthorized actions including creating, editing, or deleting Jira tickets related to vulnerabilities in projects outside their assigned scope.

Impact

Successful exploitation allows unauthorized modification of project data, which can compromise the integrity of vulnerability management workflows and lead to project-wide interference.

Recommendation

Inventory all instances of Cervantes v1.3-beta within the environment. If identified, restrict access to the JiraController component or upgrade to a patched version once provided by the vendor.

]]>highadvisory