What is the CVSS score of CVE-2026-32823?

CVE-2026-32823 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

dataCycle-CORE CVE-2026-32823

EUVD-2026-45997 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-20 GitHub_M

CSRF Datacycle Core

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered CSRF requiring passive victim interaction and no attacker credentials; integrity impact limited to content insertion for standard users, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 18:23 vuln.today

DescriptionCVE.org

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes. Because browsers automatically send cookies on same-site top-level navigation and Rails does not apply CSRF protections to GET, an attacker can force a logged-in victim to modify application state by embedding a link, image, iframe, or redirect to one of these endpoints. This was confirmed on the target with a normal Standard account: a cross-site-style GET to watch_lists/:id/add_item?thing_id=... inserted content into a watch list with no CSRF token. Additional GET mutation routes exist in the codebase, including user impersonation for authorized admins and cache or translation state changes. This is patched in version 26.06.08.

AnalysisAI

Cross-site request forgery in dataCycle-CORE (≤ 25.07.3) enables remote attackers to force authenticated users into unintended state changes by exploiting the application's use of GET routes for server-side mutations. Because Rails does not apply CSRF token validation to GET requests and browsers automatically submit session cookies on cross-site top-level navigations, an attacker who tricks a logged-in victim into visiting a malicious page can silently modify application state - confirmed with watch list manipulation on Standard accounts and potentially user impersonation for admin-level victims. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify target dataCycle-CORE instance and enumerate resource IDs

Delivery

Craft malicious page embedding GET mutation URL

Exploit

Deliver link via phishing, forum post, or redirect

Execution

Victim's browser auto-submits authenticated GET with session cookies

Persist

Rails processes request without CSRF validation

Impact

Server executes state change (watch list mutation or admin impersonation)

Access

Identify target dataCycle-CORE instance and enumerate resource IDs

Delivery

Craft malicious page embedding GET mutation URL

Exploit

Deliver link via phishing, forum post, or redirect

Execution

Victim's browser auto-submits authenticated GET with session cookies

Persist

Rails processes request without CSRF validation

Impact

Server executes state change (watch list mutation or admin impersonation)

Vulnerability AssessmentAI

Exploitation	The victim must hold an active authenticated session in dataCycle-CORE at the time the malicious request is triggered - the attack delivers no benefit against logged-out users. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS 3.1 score of 4.3 (Medium) reflects the correct attack profile: network-accessible (AV:N), low complexity (AC:L), no attacker authentication required (PR:N), user interaction required (UI:R), unchanged scope (S:U), no confidentiality loss (C:N), limited integrity impact (I:L), and no availability impact (A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker embeds a zero-pixel img tag in a phishing email or forum post pointing to the victim's dataCycle-CORE instance, such as `<img src='https://target.example.com/watch_lists/42/add_item?thing_id=999'>`. When a logged-in Standard user's browser loads the email or page, it silently issues the GET request with session cookies attached, inserting attacker-chosen content into watch list 42 with no CSRF token required and no visible indication to the victim. …
Remediation	Upgrade to dataCycle-CORE version 26.06.08, which is confirmed as the patched release per the vendor's GitHub Security Advisory at https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-55wx-jh6w-jc57. … Detailed patch versions, workarounds, and compensating controls in full report.