Missing Authorization Vulnerability in DataCap Affects Privilege Control

CVE-2026-119654

What is CVE-2026-119654?

DataCap versions up to 2025.1.1 are susceptible to a missing authorization vulnerability which permits authenticated users to escalate privileges. Specifically, any user, including those with self-registered accounts, can exploit this flaw by sending PUT requests to the API endpoint /api/v1/user/allocationRole. This action enables them to assign themselves the administrator role, granting unrestricted access to the system. Organizations using DataCap must take immediate steps to mitigate this vulnerability to safeguard their systems from potential abuse.

References