CyberRota Analysis
AI-GeneratedThe dataCycle data management system is vulnerable in versions prior to 25.07.3, allowing authenticated API users to exploit the collection API to evaluate permissions as different users by supplying a `user_email`. This could lead to unauthorized access to sensitive collections and potential cross-user modifications through the API. Organizations using dataCycle, especially those handling sensitive data, should prioritize updating to version 26.06.08 or later to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated API user who has their own access token can ask the collection API to evaluate permissions as a different user by supplying `user_email`. If the target user has collections, this can expose those collections through the API. In V4, once a collection id is known, the same controller also offers `add_item` and `remove_item` routes without any object-level `authorize!` checks, creating a likely cross-user modification path. This is patched in version 26.06.08.