What is the CVSS score of EUVD-2026-45993?

EUVD-2026-45993 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

dataCycle-CORE EUVD-2026-45993

| CVE-2026-32819 MEDIUM

Improper Authorization (CWE-285)

2026-07-20 GitHub_M

Authentication Bypass Datacycle Core

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable endpoint exploitable by any Standard user (PR:L); only user directory attributes exposed, capping confidentiality at C:L with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 18:23 vuln.today

DescriptionCVE.org

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a Standard user can enumerate other users' names and email addresses through /users/search, even though direct access to those user profiles is denied. This leaks internal staff addresses, full names, and existence of guest and external test accounts.

AnalysisAI

Improper authorization in dataCycle-CORE versions up to and including 25.07.3 allows any Standard user to enumerate the full names and email addresses of other users - including internal staff, guest accounts, and external test accounts - via the /users/search endpoint, bypassing access controls that correctly deny direct user profile access. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity network exploitation by any authenticated Standard user with no user interaction required. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain Standard user credentials

Delivery

Authenticate to dataCycle-CORE

Exploit

Send queries to /users/search endpoint

Execution

Enumerate full names and email addresses

Impact

Harvest user directory for phishing or reconnaissance

Access

Obtain Standard user credentials

Delivery

Authenticate to dataCycle-CORE

Exploit

Send queries to /users/search endpoint

Execution

Enumerate full names and email addresses

Impact

Harvest user directory for phishing or reconnaissance

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid Standard user account within the dataCycle-CORE application - the CVSS vector PR:L confirms authentication is required, ruling out unauthenticated external exploitation. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 4.3 (Medium) accurately reflects the constrained impact - limited confidentiality only (C:L), no integrity or availability dimension, and requiring a Standard user credential (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with a Standard user account authenticates to the dataCycle-CORE application and queries the `/users/search` endpoint with enumerable patterns such as common name prefixes or email domain fragments. The endpoint returns full names and email addresses of internal staff and account holders - including guest and external test accounts - without triggering the profile-level access restrictions. …
Remediation	Upgrade dataCycle-CORE to a version beyond 25.07.3, as all versions up to and including that release are confirmed affected per the vendor advisory at https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-c4wj-q23r-mq2q. … Detailed patch versions, workarounds, and compensating controls in full report.