CVE-2026-32825
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In dataCycle-CORE before version 25.07.3, there are no limits on login attempts via browser or API. Account locking is disabled and requests are not rate-limited, allowing continuous password guessing.
Risk Assessment
An attacker can guess a user's password, obtain a session or JWT token, and take over the account, leading to unauthorized data access.
Recommendation
Update dataCycle-CORE to version 26.06.08 or later, which includes a fix for this vulnerability.
Other vulnerabilities in dataCycle-CORE
See all- CVE-2026-32824High
In dataCycle-CORE before version 25.07.3, an authenticated low-privileged API user can supply custom URLs in password reset or confirmation flows. These URLs are embedded in emails without host allowlisting.
- CVE-2026-32823Medium
In dataCycle-CORE before version 26.06.08, the application exposes server-side state changes through `GET` routes. Because browsers automatically send cookies on same-site top-level navigation and Rails does not apply CSRF protections to `GET`, an attacker can force a logged-in victim to modify application state by embedding a link, image, iframe, or redirect to one of these endpoints.
- CVE-2026-32821High
In dataCycle-CORE before version 25.07.3, an authenticated API user can use their access token to query the collection API for permissions of another user by supplying their email. If the target user has collections, they may be exposed. In V4, a known collection can be modified via add/remove items without proper authorization.
- CVE-2026-32820High
In dataCycle-CORE before version 25.07.3, the documentation and static Markdown renderer improperly handles attacker-controlled path segments. An unauthenticated attacker can use directory traversal sequences to read arbitrary .md files outside the intended docs or static directories.
- CVE-2026-32819Medium
In dataCycle-CORE before version 25.07.3, a Standard user can enumerate other users' names and email addresses through the /users/search endpoint, even though direct access to user profiles is denied.
- CVE-2026-32806High
Vulnerability in dataCycle-CORE before version 26.06.08 (including 25.07.3). The /remote_render endpoint does not restrict which partials can be rendered, allowing a low-privileged authenticated user to access server-side rendered admin content.
- CVE-2026-32822Medium
Reflected DOM XSS vulnerability in dataCycle-CORE before version 25.07.3. An unauthenticated attacker can inject arbitrary HTML into flash notifications on public routes, and the toast component injects that content into the DOM via innerHTML, allowing script execution via a crafted link.
- CVE-2026-32807High
Vulnerability in dataCycle-CORE before version 26.06.08 (including 25.07.3). Anyone with a DataLink UUID can fetch the attached text file directly, even if the link is expired, the caller is unauthenticated, or the normal show flow would have denied access.
Original NVD description (English source)
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the browser login flow and the JSON login endpoint. The source code enables Devise's `:lockable` module on the user model but explicitly disables both lock and unlock strategies, and no request throttling or rate-limiting layer was identified in the Rails code. This creates a direct online password-guessing risk: - valid user accounts can be attacked continuously without temporary lockout - the same weakness is reachable through both `/users/sign_in` and `/api/v4/auth/login` - successful guessing yields a normal session cookie in the HTML flow or a fresh JWT in the API flow - the API endpoint is especially attractive for automation because it requires no CSRF token This has been patched in version 26.06.08.