CVE-2026-32806: high-severity vulnerability in datacycle-engine dataCycle-CORE
dataCycle Authorization Bypass Via /remote_render
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.4%
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated user can request arbitrary partials or helper-backed render functions through /remote_render. The endpoint does not restrict which partial can be rendered and does not apply controller-specific authorization before rendering the selected view. This enables a low-privileged user to retrieve server-side rendered admin content that is otherwise hidden by navigation and route checks. On the test instance, a Standard user was able to retrieve the PostgreSQL admin dashboard stats even though /admin itself redirected away. This is patched in 26.06.08.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
datacycle-engine · dataCycle-CORERelated CVEs — datacycle-engine dataCycle-CORE
In the same product, most dangerous first.
CVE-2026-32820HIGHdataCycle Public Markdown Path Traversal Via /docs/*pathEPSS 0.9%CVE-2026-32807HIGHdataCycle Public DataLink Text File Download Ignores Validity And AuthorizationEPSS 0.4%CVE-2026-32821HIGHAPI Collection Impersonation Via user_email And Missing Object- Level AuthorizationEPSS 0.4%CVE-2026-32825HIGHdataCycle No Brute-Force Protection On Web And API Login EndpointsEPSS 0.3%CVE-2026-32824HIGHdataCycle User API Password Reset And Confirmation Flows Trust Attacker- Controlled Redirect TargetsEPSS 0.3%CVE-2026-32822MEDIUMdataCycle Unauthenticated Reflected DOM XSS Via flash[...] On Public PagesEPSS 0.3%