API impersonation and missing object-level authorization in dataCycle-CORE (CVE-2026-32821)

In dataCycle-CORE, any authenticated API user can supply a `user_email` parameter to the collection API to evaluate permissions as a different user, potentially exposing that user's collections. In V4, the same controller's `add_item` and `remove_item` routes lack object-level `authorize!` checks, creating a cross-user data modification path once a collection ID is known. Affected versions: - <= 25.07.3 We recommend updating to: 26.06.08. CVSS 8.1 · our assessment: this_week Reference: https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-vjjr-9q8g-mgx7 Details: https://vuln.today/cve/CVE-2026-32821