CVE-2026-32807 | dataCycle is a data management system for centrally storing,… | CVSS 7.5 HIGH

Description

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly, even if the link is expired, the caller is unauthenticated, or the normal show flow would have denied access. Because the route is public and the mailer embeds the direct file URL, any leaked, forwarded, logged, or stale email link can continue to expose the attachment.

Metadata

CVE ID: CVE-2026-32807
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-03-16 17:35 UTC
Published: 2026-07-20 15:31 UTC
Last updated: 2026-07-20 16:14 UTC
Primary CWE: CWE-285
CWE-285: Improper Authorization
Vendor / Product: datacycle-engine / dataCycle-CORE
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
datacycle-engine	dataCycle-CORE	—	<= 25.07.3

Weakness (CWE)

CWE	Source	Description
CWE-285	cna	CWE-285: Improper Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (1)

https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-gj99-3h7x-v4rv https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-gj99-3h7x-v4rv