Open redirect in dataCycle-CORE password reset and confirmation flows (CVE-2026-32824)

A low-privileged authenticated API user can supply attacker-controlled `forwardToUrl` and `redirectUrl` parameters when triggering password reset or account confirmation flows in dataCycle-CORE. These values are embedded into outgoing email workflows without host allowlisting, enabling phishing, token capture, confirmation hijacking, and redirection of victims from trusted email links to attacker-controlled domains. Affected versions: - <= 25.07.3 We recommend updating to: 26.06.08. CVSS 7.3 · our assessment: this_week Reference: https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-8jfx-wpjg-hf38 Details: https://vuln.today/cve/CVE-2026-32824