What is the CVSS score of CVE-2026-32807?

CVE-2026-32807 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of dataCycle are affected by CVE-2026-32807?

dataCycle-CORE versions through 25.07.3 contain a broken authorization flaw allowing unauthenticated users to download sensitive attachments indefinitely, bypassing expiration controls and access…

How to fix or mitigate CVE-2026-32807?

Within 24 hours, audit dataCycle CORE logs for DataLink access patterns to identify potentially compromised attachments, and immediately notify affected recipients if sensitive files were exposed through leaked or forwarded email links. Within 7 days, inventory all DataLinks created in versions through 25.07.3 and assess the compliance and business risk of exposed documents; note that no vendor-released patch identified at time of analysis, so contact dataCycle support to confirm release timeline. Within 30 days, plan and execute upgrade to patched version once available; for high-risk attachments shared during the vulnerable period, revoke existing DataLinks and re-issue through alternative secure channels.

dataCycle CVE-2026-32807

EUVD-2026-45980 HIGH

Improper Authorization (CWE-285)

2026-07-20 GitHub_M

Authentication Bypass Datacycle Core Datacycle Engine

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network request to a public route (AV:N/PR:N/UI:N) discloses a protected attachment (C:H); no integrity or availability impact and no scope change, matching the NVD vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:53 vuln.today

CVE Published

Jul 20, 2026 - 15:31 cve.org

HIGH 7.5

DescriptionCVE.org

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly, even if the link is expired, the caller is unauthenticated, or the normal show flow would have denied access. Because the route is public and the mailer embeds the direct file URL, any leaked, forwarded, logged, or stale email link can continue to expose the attachment.

AnalysisAI

Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any remote, unauthenticated caller download a DataLink text attachment directly by supplying its DataLink UUID, bypassing expiration checks and the access controls enforced by the normal show flow. Because the file-serving route is public and dataCycle's mailer embeds the direct file URL, any leaked, forwarded, logged, or stale email link permanently exposes the attachment. No public exploit identified at time of analysis and it is not listed in CISA KEV, but SSVC rates the flaw automatable with partial technical impact.

Technical ContextAI

dataCycle is a Ruby-based (dataCycle-engine) data management platform used to centrally store, manage, search, and distribute data. The vulnerability lives in the DataLink feature, which generates shareable links (identified by a UUID) to attached files and delivers them via email through the mailer subsystem. The mailer embeds a direct file-serving URL rather than routing recipients through the guarded 'show' controller action. Per CWE-285 (Improper Authorization), the direct-download route performs the file lookup by UUID without re-applying the authorization and link-expiration checks that the show flow enforces, so possession of the UUID alone is sufficient to retrieve the file regardless of caller identity or link validity.

RemediationAI

Patch available per vendor advisory: upgrade dataCycle-CORE to a fixed release published after 25.07.3 as directed in GHSA-gj99-3h7x-v4rv (https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-gj99-3h7x-v4rv); the exact patched version is not stated in the available data and should be confirmed against the advisory before deployment. As compensating controls until patched, restrict or disable the public direct file-download route so attachment access is forced back through the guarded show flow that enforces expiration and authorization (side effect: legitimate email recipients may need to re-authenticate to reach files), rotate or invalidate existing DataLink UUIDs to render already-leaked links useless (side effect: previously shared links stop working), and place the file-serving endpoint behind authentication or an application gateway that revalidates link expiry. Additionally, audit mail logs and forwarding sinks that may have captured direct file URLs, since exposed links remain valid until the route is fixed.