What is the CVSS score of CVE-2026-32823?

CVE-2026-32823 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

dataCycle-CORE CVE-2026-32823

EUVD-2026-45997 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-20 GitHub_M

CSRF Datacycle Core Datacycle Engine

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered CSRF requiring passive victim interaction and no attacker credentials; integrity impact limited to content insertion for standard users, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 18:23 vuln.today

DescriptionCVE.org

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes. Because browsers automatically send cookies on same-site top-level navigation and Rails does not apply CSRF protections to GET, an attacker can force a logged-in victim to modify application state by embedding a link, image, iframe, or redirect to one of these endpoints. This was confirmed on the target with a normal Standard account: a cross-site-style GET to watch_lists/:id/add_item?thing_id=... inserted content into a watch list with no CSRF token. Additional GET mutation routes exist in the codebase, including user impersonation for authorized admins and cache or translation state changes. This is patched in version 26.06.08.

AnalysisAI

Cross-site request forgery in dataCycle-CORE (≤ 25.07.3) enables remote attackers to force authenticated users into unintended state changes by exploiting the application's use of GET routes for server-side mutations. Because Rails does not apply CSRF token validation to GET requests and browsers automatically submit session cookies on cross-site top-level navigations, an attacker who tricks a logged-in victim into visiting a malicious page can silently modify application state - confirmed with watch list manipulation on Standard accounts and potentially user impersonation for admin-level victims. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch was released in version 26.06.08.

Technical ContextAI

dataCycle-CORE (CPE: cpe:2.3:a:datacycle-engine:datacycle-core:*:*:*:*:*:*:*:*) is a Ruby on Rails-based data management platform handling content storage, search, and distribution. The root cause is CWE-352 (Cross-Site Request Forgery): Rails' built-in authenticity token enforcement is applied only to non-idempotent HTTP methods (POST, PUT, PATCH, DELETE) and not to GET requests, consistent with the HTTP specification's expectation that GET is safe and idempotent. dataCycle-CORE violates that expectation by implementing state-mutating logic - including watch list item insertion, user impersonation for admins, and cache or translation state changes - behind GET endpoints. Because browsers include session cookies on cross-site GET requests triggered by img tags, iframes, link prefetches, or redirects, the victim's authenticated session is automatically leveraged without their awareness.

RemediationAI

Upgrade to dataCycle-CORE version 26.06.08, which is confirmed as the patched release per the vendor's GitHub Security Advisory at https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-55wx-jh6w-jc57. If immediate upgrade is not possible, the following compensating controls should be considered: set the session cookie attribute SameSite=Strict, which prevents browsers from sending cookies on cross-site navigations and directly blocks this attack class - note this may break any legitimate cross-site authentication flows currently in use. Alternatively, configure a WAF or reverse proxy rule to reject GET requests to the known mutation endpoints (such as watch_lists/:id/add_item) when the Origin or Referer header does not match the application's own domain; this is effective but requires maintaining an accurate list of mutation GET routes as the application evolves. Restricting network access to the dataCycle-CORE interface to trusted internal networks reduces the attacker's ability to deliver the payload but does not eliminate the risk if users browse the web from the same network. None of these workarounds is a substitute for patching.