CVE-2026-32819: fallo de gravedad media en datacycle-engine dataCycle-CORE
dataCycle User Directory Enumeration Via /users/search
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.3%
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a Standard user can enumerate other users' names and email addresses through `/users/search`, even though direct access to those user profiles is denied. This leaks internal staff addresses, full names, and existence of guest and external test accounts.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Productos afectados
datacycle-engine · dataCycle-CORECVEs relacionadas — datacycle-engine dataCycle-CORE
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-32820HIGHdataCycle Public Markdown Path Traversal Via /docs/*pathEPSS 0.9%CVE-2026-32806HIGHdataCycle Authorization Bypass Via /remote_renderEPSS 0.4%CVE-2026-32807HIGHdataCycle Public DataLink Text File Download Ignores Validity And AuthorizationEPSS 0.4%CVE-2026-32821HIGHAPI Collection Impersonation Via user_email And Missing Object- Level AuthorizationEPSS 0.4%CVE-2026-32825HIGHdataCycle No Brute-Force Protection On Web And API Login EndpointsEPSS 0.3%CVE-2026-32824HIGHdataCycle User API Password Reset And Confirmation Flows Trust Attacker- Controlled Redirect TargetsEPSS 0.3%