CyberRota Analysis
AI-GeneratedThe dataCycle-CORE module, prior to version 25.07.3, is vulnerable due to inadequate authorization controls on the /remote_render endpoint, allowing authenticated users to access sensitive server-side rendered content, including admin-level information. This flaw can lead to unauthorized data exposure, potentially compromising the integrity and confidentiality of the system. Organizations using affected versions should prioritize patching to version 26.06.08 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated user can request arbitrary partials or helper-backed render functions through /remote_render. The endpoint does not restrict which partial can be rendered and does not apply controller-specific authorization before rendering the selected view. This enables a low-privileged user to retrieve server-side rendered admin content that is otherwise hidden by navigation and route checks. On the test instance, a Standard user was able to retrieve the PostgreSQL admin dashboard stats even though /admin itself redirected away. This is patched in 26.06.08.