EUVD-2026-45980Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network request to a public route (AV:N/PR:N/UI:N) discloses a protected attachment (C:H); no integrity or availability impact and no scope change, matching the NVD vector.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly, even if the link is expired, the caller is unauthenticated, or the normal show flow would have denied access. Because the route is public and the mailer embeds the direct file URL, any leaked, forwarded, logged, or stale email link can continue to expose the attachment.
AnalysisAI
Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any remote, unauthenticated caller download a DataLink text attachment directly by supplying its DataLink UUID, bypassing expiration checks and the access controls enforced by the normal show flow. Because the file-serving route is public and dataCycle's mailer embeds the direct file URL, any leaked, forwarded, logged, or stale email link permanently exposes the attachment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires possession of a valid DataLink UUID for a file attachment; the attacker does not need authentication, an unexpired link, or the access rights the normal show flow would demand, because the public direct-download route skips those checks. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable, unauthenticated confidentiality-only disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker obtains a dataCycle DataLink URL containing a valid DataLink UUID - for example from a forwarded email, a mail-server log, a proxy log, or a stale message thread - and requests it directly without authenticating. Even though the link has expired or the recipient's access would normally be denied, the public route returns the attached text file. … |
| Remediation | Patch available per vendor advisory: upgrade dataCycle-CORE to a fixed release published after 25.07.3 as directed in GHSA-gj99-3h7x-v4rv (https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-gj99-3h7x-v4rv); the exact patched version is not stated in the available data and should be confirmed against the advisory before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit dataCycle CORE logs for DataLink access patterns to identify potentially compromised attachments, and immediately notify affected recipients if sensitive files were exposed through leaked or forwarded email links. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Datacycle Core
View allBroken object-level authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated API us
Arbitrary file disclosure in dataCycle-CORE (versions up to and including 25.07.3) allows an unauthenticated remote atta
Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated low-privileged user
Account takeover via unthrottled online password guessing affects dataCycle-CORE (versions up to and including 25.07.3),
Open redirect and token-theft in dataCycle-CORE (all versions up to and including 25.07.3) lets a low-privileged authent
Reflected DOM XSS in dataCycle-CORE versions up to and including 25.07.3 allows unauthenticated remote attackers to inje
Improper authorization in dataCycle-CORE versions up to and including 25.07.3 allows any Standard user to enumerate the
Cross-site request forgery in dataCycle-CORE (≤ 25.07.3) enables remote attackers to force authenticated users into unin
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today