CVE-2026-129427
HIGH
NVD
CVSS Score
8.7
Severity
HIGH
Published
Nov 14, 2026
Vendor
unknown
Description
Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges