CVE-2026-32806
Received Received - Intake

Authenticated Path Traversal in dataCycle-CORE

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated user can request arbitrary partials or helper-backed render functions through /remote_render. The endpoint does not restrict which partial can be rendered and does not apply controller-specific authorization before rendering the selected view. This enables a low-privileged user to retrieve server-side rendered admin content that is otherwise hidden by navigation and route checks. On the test instance, a Standard user was able to retrieve the PostgreSQL admin dashboard stats even though /admin itself redirected away. This is patched in 26.06.08.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-32806
EUVD
EUVD-2026-45995

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
datacycle datacycle-core to 25.07.3 (inc)
datacycle datacycle-core to 26.07.01 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in dataCycle-CORE versions before 26.06.08. The /remote_render endpoint allows any authenticated user to request arbitrary server-side rendered content without proper access controls. This lets low-privileged users retrieve admin-only content like PostgreSQL dashboard stats that should be restricted.

Detection Guidance

Check if your dataCycle-CORE version is 26.06.11 or earlier. Inspect server logs for requests to /remote_render endpoints with unusual parameters or responses containing admin dashboard content. Verify if low-privileged users can access admin-only data through this endpoint.

Impact Analysis

An attacker with basic user access could exploit this to view sensitive admin data such as internal table names, operational details, or other restricted server-side rendered content. This could lead to further attacks or data breaches by exposing confidential information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR or HIPAA. Exposure of personal or health information due to insufficient access controls may result in regulatory penalties or legal consequences.

Mitigation Strategies

Upgrade dataCycle-CORE to version 26.07.01 or later immediately. If immediate upgrade is not possible, restrict access to the /remote_render endpoint via network controls or firewall rules until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32806. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart