DataCap EUVD-2026-114070

Exploitation requires an authenticated account on the DataCap instance and network reachability to the REST API; the attacker calls the administrative role/menu management endpoints - specifically a PUT to /api/v1/user/allocationRole - which lack authorization enforcement, to grant their own account the administrator role. The practical barrier collapses where self-registration is enabled, since the description states self-registered accounts suffice, meaning no pre-existing privileged credentials are needed. Limiting factors: the attacker must be able to obtain or possess a valid low-privileged account (if self-registration is disabled, prior credentials are required), and must reach the API over the network; no user interaction and no high privileges are required. Affected: DataCap (devlive-community) through 2025.1.1.

This is a genuine high-priority issue rather than an inflated-CVSS artifact. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable flaw of low complexity requiring only a low-privileged account and no user interaction, with full high impact to confidentiality, integrity and availability of the vulnerable system (VC:H/VI:H/VA:H), scored 8.7. The description elevates real-world concern: because self-registered accounts can reach the vulnerable administrative APIs, the PR:L barrier is effectively trivial wherever open registration is enabled, turning a low-privilege account into full administrator control. The vuln.today decision label is 'this_week', indicating prioritized remediation rather than drop-everything emergency. Signals are consistent but not maximal: this is NOT in CISA KEV, so there is no confirmed active exploitation, and no EPSS probability was supplied, so widespread automated exploitation cannot be quantified from the input. A public technical write-up (hackmd) and VulnCheck advisory exist, which lowers the attacker research barrier even though the input does not confirm packaged working exploit code. Net: trivial exploitation and full instance compromise make this a real priority to patch promptly, tempered by the product's limited deployment footprint (see prevalence) and absence of confirmed in-the-wild use.

An attacker obtains a low-privileged DataCap account - either existing credentials or, where open sign-up is enabled, a self-registered account - then sends a PUT request to /api/v1/user/allocationRole assigning themselves the administrator role. Because the administrative role and menu management APIs lack authorization checks, the attacker gains full administrative control of the instance. A public technical write-up describing the endpoint and request exists; it is not verified in the input as working exploit code.