What is the CVSS score of CVE-2026-32819?

CVE-2026-32819 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

dataCycle-CORE CVE-2026-32819

EUVD-2026-45993 MEDIUM

Improper Authorization (CWE-285)

2026-07-20 GitHub_M

Authentication Bypass Datacycle Core Datacycle Engine

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable endpoint exploitable by any Standard user (PR:L); only user directory attributes exposed, capping confidentiality at C:L with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 18:23 vuln.today

DescriptionCVE.org

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a Standard user can enumerate other users' names and email addresses through /users/search, even though direct access to those user profiles is denied. This leaks internal staff addresses, full names, and existence of guest and external test accounts.

AnalysisAI

Improper authorization in dataCycle-CORE versions up to and including 25.07.3 allows any Standard user to enumerate the full names and email addresses of other users - including internal staff, guest accounts, and external test accounts - via the /users/search endpoint, bypassing access controls that correctly deny direct user profile access. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity network exploitation by any authenticated Standard user with no user interaction required. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.

Technical ContextAI

dataCycle-CORE (CPE: cpe:2.3:a:datacycle-engine:datacycle-core:*:*:*:*:*:*:*:*) is the framework layer of the dataCycle data management platform, responsible for core processing, access rules, and API routing. The root cause is CWE-285 (Improper Authorization) - an inconsistency in authorization enforcement between the user profile route (which correctly restricts Standard users) and the /users/search aggregation endpoint (which does not). This is a textbook broken object-level authorization pattern: the system enforces controls on direct resource access but fails to apply equivalent checks on an indirect search path that returns the same sensitive attributes. The exposed data includes full names, email addresses, and account existence signals for all user types, including guest and external test accounts.

RemediationAI

Upgrade dataCycle-CORE to a version beyond 25.07.3, as all versions up to and including that release are confirmed affected per the vendor advisory at https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-c4wj-q23r-mq2q. Note that an explicit patched version number is not stated in the available input data - the fix version beyond 25.07.3 should be confirmed directly from the advisory before upgrading. If an immediate upgrade is not possible, restrict access to the /users/search endpoint at the reverse proxy or WAF layer to administrator-role sessions only; this trade-off disables user search functionality for Standard users but eliminates the enumeration surface. Additionally, audit other aggregation or search endpoints in the application for similar authorization inconsistencies, as the same pattern may affect other data types.