CVE-2026-32822: medium-severity vulnerability in datacycle-engine dataCycle-CORE
dataCycle Unauthenticated Reflected DOM XSS Via flash[...] On Public Pages
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.3%
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any unauthenticated attacker can place arbitrary HTML into flash notifications on public routes and rely on the frontend toast component to inject that content into the DOM with `innerHTML`. This creates a reflected DOM XSS that can be delivered with a crafted link to a public page such as `/docs`. Because the vulnerable JavaScript is loaded by the normal application layout, the issue is not limited to a special debug page or an isolated admin-only view.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
datacycle-engine · dataCycle-CORERelated CVEs — datacycle-engine dataCycle-CORE
In the same product, most dangerous first.
CVE-2026-32820HIGHdataCycle Public Markdown Path Traversal Via /docs/*pathEPSS 0.9%CVE-2026-32806HIGHdataCycle Authorization Bypass Via /remote_renderEPSS 0.4%CVE-2026-32807HIGHdataCycle Public DataLink Text File Download Ignores Validity And AuthorizationEPSS 0.4%CVE-2026-32821HIGHAPI Collection Impersonation Via user_email And Missing Object- Level AuthorizationEPSS 0.4%CVE-2026-32825HIGHdataCycle No Brute-Force Protection On Web And API Login EndpointsEPSS 0.3%CVE-2026-32824HIGHdataCycle User API Password Reset And Confirmation Flows Trust Attacker- Controlled Redirect TargetsEPSS 0.3%