CyberRota Analysis
AI-GeneratedThe dataCycle-CORE application, prior to version 26.06.08, is vulnerable to cross-site request forgery (CSRF) due to the exposure of server-side state changes through `GET` routes without adequate CSRF protections. This flaw allows attackers to manipulate application state on behalf of authenticated users by tricking them into clicking malicious links or loading images. Organizations using affected versions of dataCycle should prioritize patching to mitigate potential unauthorized actions, especially those with user impersonation capabilities.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through `GET` routes. Because browsers automatically send cookies on same-site top-level navigation and Rails does not apply CSRF protections to `GET`, an attacker can force a logged-in victim to modify application state by embedding a link, image, iframe, or redirect to one of these endpoints. This was confirmed on the target with a normal `Standard` account: a cross-site-style `GET` to `watch_lists/:id/add_item?thing_id=...` inserted content into a watch list with no CSRF token. Additional `GET` mutation routes exist in the codebase, including user impersonation for authorized admins and cache or translation state changes. This is patched in version 26.06.08.