What is the CVSS score of EUVD-2026-45995?

EUVD-2026-45995 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of dataCycle are affected by EUVD-2026-45995?

dataCycle-CORE versions through 25.07.3 expose confidential administrative data-including database system statistics-to any standard application user, creating organizational risk of unauthorized…

How to fix or mitigate EUVD-2026-45995?

Within 24 hours: inventory all dataCycle-CORE deployments, identify instances running version 25.07.3 or earlier, and implement network-level restrictions on the /remote_render endpoint if immediate patching is not feasible. Within 7 days: complete testing of dataCycle-CORE version 26.06.08 in staging environments and finalize deployment schedule, prioritizing systems with the highest user count or most sensitive operational data. Within 30 days: deploy version 26.06.08 to all production systems and audit access logs for suspicious admin endpoint requests from low-privileged accounts during the vulnerability exposure window.

dataCycle EUVD-2026-45995

| CVE-2026-32806 HIGH

Improper Authorization (CWE-285)

2026-07-20 GitHub_M

Authentication Bypass PostgreSQL Datacycle Core Datacycle Engine

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Description confirms any authenticated user can exploit, so PR:L not PR:N; network low-complexity request, no UI, unchanged scope, confidentiality-only impact so I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:58 vuln.today

CVE Published

Jul 20, 2026 - 16:10 cve.org

HIGH 7.5

DescriptionCVE.org

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated user can request arbitrary partials or helper-backed render functions through /remote_render. The endpoint does not restrict which partial can be rendered and does not apply controller-specific authorization before rendering the selected view. This enables a low-privileged user to retrieve server-side rendered admin content that is otherwise hidden by navigation and route checks. On the test instance, a Standard user was able to retrieve the PostgreSQL admin dashboard stats even though /admin itself redirected away. This is patched in 26.06.08.

AnalysisAI

Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated low-privileged user reach server-side rendered admin content via the /remote_render endpoint, which renders arbitrary partials and helper-backed views without enforcing controller-specific authorization. On a test instance a Standard user retrieved the PostgreSQL admin dashboard statistics even though direct access to /admin redirected the user away, confirming an information-disclosure impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is fixed in 26.06.08.

Technical ContextAI

dataCycle is a Ruby-on-Rails-style data management system for centrally storing, managing, searching and distributing data; dataCycle-CORE is the module handling core processing and framework rules. The flaw sits in the /remote_render endpoint, which is designed to render server-side view fragments (partials) and helper-backed render functions. Because the endpoint accepts the target partial/helper from the request and does not run the controller-specific authorization (before_action / policy checks) that normally gate those views, it exposes rendering paths that the application otherwise hides behind navigation and route-level checks. This maps to CWE-285 (Improper Authorization): the code authenticates the session but fails to verify that the user is authorized for the specific view/resource being rendered, so trust in route-level hiding is bypassed by calling the renderer directly.

RemediationAI

Vendor-released patch: upgrade dataCycle-CORE to version 26.06.08, which enforces authorization before rendering via /remote_render. Follow the guidance in advisory GHSA-xc6g-2v4c-456c (https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-xc6g-2v4c-456c). If immediate upgrade is not possible, restrict or block access to the /remote_render route at a reverse proxy or WAF (allowing it only for trusted admin roles), which prevents the disclosure but will break any legitimate remote-render/partial functionality the application depends on; alternatively, tighten role assignment so that only trusted, higher-privilege accounts can authenticate, reducing the pool of users able to abuse the endpoint at the cost of not fixing the underlying missing authorization check. Because impact is confidentiality of admin content, also review whether any sensitive data (such as PostgreSQL dashboard stats) exposed during the vulnerable window should be treated as potentially disclosed.