CyberRota Analysis
AI-GeneratedThe dataCycle-CORE module prior to version 25.07.3 is vulnerable to abuse by low-privileged authenticated API users who can manipulate `forwardToUrl` and `redirectUrl` parameters during password reset or confirmation processes. This flaw allows attackers to craft phishing links that can capture tokens or redirect victims to malicious sites, posing significant risks of credential theft and account compromise. Organizations using affected versions should prioritize patching to version 26.06.08 to mitigate these vulnerabilities.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply `forwardToUrl` and `redirectUrl` values when triggering password reset or confirmation flows. Those values are then embedded into the outgoing email workflow without host allowlisting. This creates two related abuse paths: - password reset or confirmation links can be sent to a victim with the token already attached to an attacker-controlled `forwardToUrl` - after a legitimate password reset completes, the browser is redirected to attacker-controlled `redirectUrl` In practice, this can be used for phishing, token capture, confirmation hijacking, or steering a victim from a trusted email into an attacker domain. This is patched in version 26.06.08.