EUVD-2026-45999Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Unauthenticated network login abuse, so PR:N/UI:N; success depends on password strength giving AC:H; account takeover yields C:H/I:H, no availability impact so A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the browser login flow and the JSON login endpoint. The source code enables Devise's :lockable module on the user model but explicitly disables both lock and unlock strategies, and no request throttling or rate-limiting layer was identified in the Rails code. This creates a direct online password-guessing risk:
- valid user accounts can be attacked continuously without temporary lockout
- the same weakness is reachable through both
/users/sign_inand/api/v4/auth/login - successful guessing yields a normal session cookie in the HTML flow or a fresh JWT in the API flow
- the API endpoint is especially attractive for automation because it requires no CSRF token
This has been patched in version 26.06.08.
AnalysisAI
Account takeover via unthrottled online password guessing affects dataCycle-CORE (versions up to and including 25.07.3), the data management engine that stores and distributes centralized data. Because Devise's :lockable module is enabled but both lock and unlock strategies are explicitly disabled - and no request throttling exists anywhere in the Rails stack - attackers can attempt unlimited credential guesses against both /users/sign_in and the CSRF-free /api/v4/auth/login JSON endpoint, obtaining a session cookie or JWT on success. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to either the /users/sign_in browser endpoint or the /api/v4/auth/login JSON API of a dataCycle-CORE instance at version 25.07.3 or earlier, plus at least one valid username to target; the /api/v4/auth/login path additionally requires no CSRF token, making it the preferred automation surface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, base 7.3) is internally inconsistent with the described attack: a pre-authentication brute-force attempt does not require existing privileges (PR:L) or victim interaction (UI:R), so those two metrics appear mis-set - verify with the vendor advisory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker enumerates or guesses a valid dataCycle username and scripts a high-volume credential-guessing loop against /api/v4/auth/login, which accepts JSON POSTs without a CSRF token and never locks the account or rate-limits the source. After enough attempts against a weak or reused password, the endpoint returns a valid JWT, granting the attacker authenticated API access to the victim's data. … |
| Remediation | Vendor-released patch: 26.06.08 - upgrade dataCycle-CORE to version 26.06.08 or later, which is the primary and recommended fix per advisory GHSA-736f-cqq3-ccgf (https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-736f-cqq3-ccgf). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all production systems running dataCycle-CORE 25.07.3 or earlier and assess data classification. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Datacycle Core
View allBroken object-level authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated API us
Arbitrary file disclosure in dataCycle-CORE (versions up to and including 25.07.3) allows an unauthenticated remote atta
Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated low-privileged user
Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any remote, unauthenticated caller do
Open redirect and token-theft in dataCycle-CORE (all versions up to and including 25.07.3) lets a low-privileged authent
Reflected DOM XSS in dataCycle-CORE versions up to and including 25.07.3 allows unauthenticated remote attackers to inje
Improper authorization in dataCycle-CORE versions up to and including 25.07.3 allows any Standard user to enumerate the
Cross-site request forgery in dataCycle-CORE (≤ 25.07.3) enables remote attackers to force authenticated users into unin
Share
External POC / Exploit Code
Leaving vuln.today