Unauthorized Access Vulnerability in dataCycle for Data Management
CVE-2026-32807

7.5HIGH

Key Information:

Vendor

Datacycle-engine

Status
Datacycle-core
Vendor
CVE Published:
20 July 2026

What is CVE-2026-32807?

The dataCycle-CORE module presents a vulnerability that allows unauthorized users to access attached text files via a DataLink UUID. The issue arises from its public route, which does not validate user authentication, enabling access to files even after the expiration of links. As a result, any leaked, forwarded, or stale email links may compromise sensitive data, exposing it to individuals without proper authorization.

Affected Version(s)

dataCycle-CORE <= 25.07.3

References

https://github.com/datacycle-engine/dataCycle-CORE/securi...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.