CVE-2026-32807: fallo de gravedad alta en datacycle-engine dataCycle-CORE
dataCycle Public DataLink Text File Download Ignores Validity And Authorization
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.4%
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly, even if the link is expired, the caller is unauthenticated, or the normal show flow would have denied access. Because the route is public and the mailer embeds the direct file URL, any leaked, forwarded, logged, or stale email link can continue to expose the attachment.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
datacycle-engine · dataCycle-CORECVEs relacionadas — datacycle-engine dataCycle-CORE
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-32820HIGHdataCycle Public Markdown Path Traversal Via /docs/*pathEPSS 0.9%CVE-2026-32806HIGHdataCycle Authorization Bypass Via /remote_renderEPSS 0.4%CVE-2026-32821HIGHAPI Collection Impersonation Via user_email And Missing Object- Level AuthorizationEPSS 0.4%CVE-2026-32825HIGHdataCycle No Brute-Force Protection On Web And API Login EndpointsEPSS 0.3%CVE-2026-32824HIGHdataCycle User API Password Reset And Confirmation Flows Trust Attacker- Controlled Redirect TargetsEPSS 0.3%CVE-2026-32822MEDIUMdataCycle Unauthenticated Reflected DOM XSS Via flash[...] On Public PagesEPSS 0.3%