Unauthorized text file download via DataLink in dataCycle-CORE (CVE-2026-32807)

dataCycle-CORE contains a public route for downloading DataLink-attached text files that does not enforce link validity, expiry, or caller authentication. Any party in possession of a DataLink UUID - including recipients of leaked, forwarded, logged, or stale email links - can retrieve the attached file regardless of whether access would otherwise be denied. This results in unauthorized disclosure of potentially sensitive file contents. Affected versions: - <= 25.07.3 We recommend updating to: 26.06.08. CVSS 7.5 · our assessment: this_week Reference: https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-gj99-3h7x-v4rv Details: https://vuln.today/cve/CVE-2026-32807