What is the CVSS score of CVE-2026-32821?

CVE-2026-32821 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Datacycle Core are affected by CVE-2026-32821?

A flaw in dataCycle-CORE enables API users to impersonate colleagues and access their data collections without authorization, creating a direct data breach risk and potential regulatory exposure.

How to fix or mitigate CVE-2026-32821?

Within 24 hours, identify all dataCycle-CORE instances in production and determine which are running version 25.07.3 or earlier. Within 7 days, prepare and validate the upgrade to version 26.06.08 in a test environment, ensuring collection-level permissions are correctly enforced post-patch. Within 30 days, execute the upgrade across all production systems and conduct access log reviews to confirm the impersonation vector is closed.

Datacycle Core CVE-2026-32821

EUVD-2026-45996 HIGH

Improper Authorization (CWE-285)

2026-07-20 GitHub_M

Authentication Bypass Datacycle Core

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:58 vuln.today

CVE Published

Jul 20, 2026 - 16:11 cve.org

HIGH 8.1

DescriptionCVE.org

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated API user who has their own access token can ask the collection API to evaluate permissions as a different user by supplying user_email. If the target user has collections, this can expose those collections through the API. In V4, once a collection id is known, the same controller also offers add_item and remove_item routes without any object-level authorize! checks, creating a likely cross-user modification path. This is patched in version 26.06.08.

AnalysisAI

Broken object-level authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated API user with a valid access token impersonate another user by passing a user_email parameter to the collection API, causing permissions to be evaluated as the victim and exposing that user's collections. In the V4 code path the same controller further exposes add_item and remove_item routes lacking object-level authorize! …