Data Management System Vulnerabilities in dataCycle by DataCycle
CVE-2026-32824

7.3HIGH

Key Information:

Vendor

Datacycle-engine

Status
Datacycle-core
Vendor
CVE Published:
20 July 2026

What is CVE-2026-32824?

The dataCycle-CORE data management system allows a low-privileged authenticated API user to exploit the password reset and confirmation processes by injecting malicious forwardToUrl and redirectUrl values. These values can be sent within outgoing emails, leading to serious security risks, including phishing attacks and token capture. Attackers can leverage this to redirect users to hostile domains after a password reset, potentially compromising sensitive information. The issue has been resolved in version 26.06.08.

Affected Version(s)

dataCycle-CORE <= 25.07.3

References

https://github.com/datacycle-engine/dataCycle-CORE/securi...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.