What is the CVSS score of CVE-2026-32825?

CVE-2026-32825 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of dataCycle are affected by CVE-2026-32825?

dataCycle-CORE versions 25.07.3 and earlier allow unauthorized account access through repeated credential attacks without system protections.

How to fix or mitigate CVE-2026-32825?

Within 24 hours: identify all production systems running dataCycle-CORE 25.07.3 or earlier and assess data classification. Within 7 days: deploy emergency rate limiting and account lockout on authentication endpoints (/users/sign_in and /api/v4/auth/login) via WAF or reverse proxy, enable verbose failed-login logging to SIEM, and restrict API access to trusted IPs if operationally feasible. Within 30 days: obtain patched version from vendor, verify vendor's security roadmap, and implement continuous monitoring for brute-force patterns.

dataCycle CVE-2026-32825

EUVD-2026-45999 HIGH

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-07-20 GitHub_M

CSRF Datacycle Core Datacycle Engine

7.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Unauthenticated network login abuse, so PR:N/UI:N; success depends on password strength giving AC:H; account takeover yields C:H/I:H, no availability impact so A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:56 vuln.today

CVE Published

Jul 20, 2026 - 16:15 cve.org

HIGH 7.3

DescriptionCVE.org

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the browser login flow and the JSON login endpoint. The source code enables Devise's :lockable module on the user model but explicitly disables both lock and unlock strategies, and no request throttling or rate-limiting layer was identified in the Rails code. This creates a direct online password-guessing risk:

valid user accounts can be attacked continuously without temporary lockout
the same weakness is reachable through both /users/sign_in and /api/v4/auth/login
successful guessing yields a normal session cookie in the HTML flow or a fresh JWT in the API flow
the API endpoint is especially attractive for automation because it requires no CSRF token

This has been patched in version 26.06.08.

AnalysisAI

Account takeover via unthrottled online password guessing affects dataCycle-CORE (versions up to and including 25.07.3), the data management engine that stores and distributes centralized data. Because Devise's :lockable module is enabled but both lock and unlock strategies are explicitly disabled - and no request throttling exists anywhere in the Rails stack - attackers can attempt unlimited credential guesses against both /users/sign_in and the CSRF-free /api/v4/auth/login JSON endpoint, obtaining a session cookie or JWT on success. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the CSRF-free API path makes automated credential-stuffing and brute-force campaigns straightforward against any valid account.

Technical ContextAI

dataCycle-CORE is a Ruby on Rails application that uses the Devise authentication framework for user identity. Devise ships a :lockable module designed to freeze accounts after a configurable number of failed sign-ins; here the module is loaded on the user model but its :failed_attempts lock strategy and unlock strategy are both switched off, so failed logins are never counted toward any threshold. Compounding this, no Rack-level throttling middleware (such as rack-attack) or reverse-proxy rate limiter was found guarding the authentication routes. The result is a textbook CWE-307 (Improper Restriction of Excessive Authentication Attempts) condition exposed on two parallel surfaces: the HTML browser flow at /users/sign_in and the token-issuing JSON API at /api/v4/auth/login. The affected package is identified in CPE data as cpe:2.3:a:datacycle-engine:datacycle-core, confirming the datacycle-engine vendor and datacycle-core component.

RemediationAI

Vendor-released patch: 26.06.08 - upgrade dataCycle-CORE to version 26.06.08 or later, which is the primary and recommended fix per advisory GHSA-736f-cqq3-ccgf (https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-736f-cqq3-ccgf). If an immediate upgrade is not possible, add rate limiting in front of the authentication routes: deploy rack-attack (or equivalent) to throttle POST attempts to /users/sign_in and /api/v4/auth/login by IP and by username, accepting that overly tight limits can lock out legitimate users or shared-NAT clients. Alternatively, re-enable Devise's :lockable lock strategy (e.g. failed_attempts with a sensible maximum_attempts and unlock_in window), noting this introduces an account-lockout denial-of-service risk that attackers can weaponize against known usernames. Enforce strong password policies and MFA, and place the login/API endpoints behind a WAF or restrict them to trusted networks/VPN where feasible to reduce internet-facing exposure until patched.