Datacycle Core
Monthly
Account takeover via unthrottled online password guessing affects dataCycle-CORE (versions up to and including 25.07.3), the data management engine that stores and distributes centralized data. Because Devise's :lockable module is enabled but both lock and unlock strategies are explicitly disabled - and no request throttling exists anywhere in the Rails stack - attackers can attempt unlimited credential guesses against both /users/sign_in and the CSRF-free /api/v4/auth/login JSON endpoint, obtaining a session cookie or JWT on success. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the CSRF-free API path makes automated credential-stuffing and brute-force campaigns straightforward against any valid account.
Open redirect and token-theft in dataCycle-CORE (all versions up to and including 25.07.3) lets a low-privileged authenticated API user inject attacker-controlled `forwardToUrl` and `redirectUrl` parameters into password-reset and confirmation email flows, which lack host allowlisting. Because a live reset/confirmation token can be appended to an attacker-controlled destination, and users are redirected off-site after completing a reset, an attacker can capture tokens, hijack confirmations, and stage convincing phishing from a trusted-domain email. No public exploit or CISA KEV listing exists at time of analysis; the issue is fixed in 26.06.08.
Cross-site request forgery in dataCycle-CORE (≤ 25.07.3) enables remote attackers to force authenticated users into unintended state changes by exploiting the application's use of GET routes for server-side mutations. Because Rails does not apply CSRF token validation to GET requests and browsers automatically submit session cookies on cross-site top-level navigations, an attacker who tricks a logged-in victim into visiting a malicious page can silently modify application state - confirmed with watch list manipulation on Standard accounts and potentially user impersonation for admin-level victims. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch was released in version 26.06.08.
Broken object-level authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated API user with a valid access token impersonate another user by passing a `user_email` parameter to the collection API, causing permissions to be evaluated as the victim and exposing that user's collections. In the V4 code path the same controller further exposes `add_item` and `remove_item` routes lacking object-level `authorize!` checks, enabling a likely cross-user modification path once a collection ID is known. No public exploit is identified at time of analysis, and the flaw is fixed in version 26.06.08.
Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated low-privileged user reach server-side rendered admin content via the /remote_render endpoint, which renders arbitrary partials and helper-backed views without enforcing controller-specific authorization. On a test instance a Standard user retrieved the PostgreSQL admin dashboard statistics even though direct access to /admin redirected the user away, confirming an information-disclosure impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is fixed in 26.06.08.
Arbitrary file disclosure in dataCycle-CORE (versions up to and including 25.07.3) allows an unauthenticated remote attacker to read arbitrary .md files outside the intended docs/static directories. The documentation and static markdown renderer passes attacker-controlled path segments only through the Rails HTML sanitizer, which does not strip directory-traversal sequences, enabling path traversal to the application or engine root. No public exploit identified at time of analysis; the flaw is remotely reachable with no authentication and low complexity (CVSS 7.5). Patched in version 26.06.08.
Improper authorization in dataCycle-CORE versions up to and including 25.07.3 allows any Standard user to enumerate the full names and email addresses of other users - including internal staff, guest accounts, and external test accounts - via the `/users/search` endpoint, bypassing access controls that correctly deny direct user profile access. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity network exploitation by any authenticated Standard user with no user interaction required. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Reflected DOM XSS in dataCycle-CORE versions up to and including 25.07.3 allows unauthenticated remote attackers to inject arbitrary HTML into flash notification toast components via crafted links to public routes such as `/docs`. The frontend toast component renders attacker-supplied content directly via `innerHTML` without sanitization, enabling script execution in the victim's browser across the normal application layout - not limited to isolated or admin-only views. No active exploitation or public exploit code has been identified at time of analysis, though the unauthenticated, low-complexity network vector substantially lowers the bar for opportunistic abuse.
Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any remote, unauthenticated caller download a DataLink text attachment directly by supplying its DataLink UUID, bypassing expiration checks and the access controls enforced by the normal show flow. Because the file-serving route is public and dataCycle's mailer embeds the direct file URL, any leaked, forwarded, logged, or stale email link permanently exposes the attachment. No public exploit identified at time of analysis and it is not listed in CISA KEV, but SSVC rates the flaw automatable with partial technical impact.
Account takeover via unthrottled online password guessing affects dataCycle-CORE (versions up to and including 25.07.3), the data management engine that stores and distributes centralized data. Because Devise's :lockable module is enabled but both lock and unlock strategies are explicitly disabled - and no request throttling exists anywhere in the Rails stack - attackers can attempt unlimited credential guesses against both /users/sign_in and the CSRF-free /api/v4/auth/login JSON endpoint, obtaining a session cookie or JWT on success. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the CSRF-free API path makes automated credential-stuffing and brute-force campaigns straightforward against any valid account.
Open redirect and token-theft in dataCycle-CORE (all versions up to and including 25.07.3) lets a low-privileged authenticated API user inject attacker-controlled `forwardToUrl` and `redirectUrl` parameters into password-reset and confirmation email flows, which lack host allowlisting. Because a live reset/confirmation token can be appended to an attacker-controlled destination, and users are redirected off-site after completing a reset, an attacker can capture tokens, hijack confirmations, and stage convincing phishing from a trusted-domain email. No public exploit or CISA KEV listing exists at time of analysis; the issue is fixed in 26.06.08.
Cross-site request forgery in dataCycle-CORE (≤ 25.07.3) enables remote attackers to force authenticated users into unintended state changes by exploiting the application's use of GET routes for server-side mutations. Because Rails does not apply CSRF token validation to GET requests and browsers automatically submit session cookies on cross-site top-level navigations, an attacker who tricks a logged-in victim into visiting a malicious page can silently modify application state - confirmed with watch list manipulation on Standard accounts and potentially user impersonation for admin-level victims. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch was released in version 26.06.08.
Broken object-level authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated API user with a valid access token impersonate another user by passing a `user_email` parameter to the collection API, causing permissions to be evaluated as the victim and exposing that user's collections. In the V4 code path the same controller further exposes `add_item` and `remove_item` routes lacking object-level `authorize!` checks, enabling a likely cross-user modification path once a collection ID is known. No public exploit is identified at time of analysis, and the flaw is fixed in version 26.06.08.
Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any authenticated low-privileged user reach server-side rendered admin content via the /remote_render endpoint, which renders arbitrary partials and helper-backed views without enforcing controller-specific authorization. On a test instance a Standard user retrieved the PostgreSQL admin dashboard statistics even though direct access to /admin redirected the user away, confirming an information-disclosure impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is fixed in 26.06.08.
Arbitrary file disclosure in dataCycle-CORE (versions up to and including 25.07.3) allows an unauthenticated remote attacker to read arbitrary .md files outside the intended docs/static directories. The documentation and static markdown renderer passes attacker-controlled path segments only through the Rails HTML sanitizer, which does not strip directory-traversal sequences, enabling path traversal to the application or engine root. No public exploit identified at time of analysis; the flaw is remotely reachable with no authentication and low complexity (CVSS 7.5). Patched in version 26.06.08.
Improper authorization in dataCycle-CORE versions up to and including 25.07.3 allows any Standard user to enumerate the full names and email addresses of other users - including internal staff, guest accounts, and external test accounts - via the `/users/search` endpoint, bypassing access controls that correctly deny direct user profile access. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity network exploitation by any authenticated Standard user with no user interaction required. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Reflected DOM XSS in dataCycle-CORE versions up to and including 25.07.3 allows unauthenticated remote attackers to inject arbitrary HTML into flash notification toast components via crafted links to public routes such as `/docs`. The frontend toast component renders attacker-supplied content directly via `innerHTML` without sanitization, enabling script execution in the victim's browser across the normal application layout - not limited to isolated or admin-only views. No active exploitation or public exploit code has been identified at time of analysis, though the unauthenticated, low-complexity network vector substantially lowers the bar for opportunistic abuse.
Broken authorization in dataCycle-CORE (versions up to and including 25.07.3) lets any remote, unauthenticated caller download a DataLink text attachment directly by supplying its DataLink UUID, bypassing expiration checks and the access controls enforced by the normal show flow. Because the file-serving route is public and dataCycle's mailer embeds the direct file URL, any leaked, forwarded, logged, or stale email link permanently exposes the attachment. No public exploit identified at time of analysis and it is not listed in CISA KEV, but SSVC rates the flaw automatable with partial technical impact.