CVE-2026-32821
Received Received - Intake

Authenticated API Permission Bypass in dataCycle-CORE

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated API user who has their own access token can ask the collection API to evaluate permissions as a different user by supplying `user_email`. If the target user has collections, this can expose those collections through the API. In V4, once a collection id is known, the same controller also offers `add_item` and `remove_item` routes without any object-level `authorize!` checks, creating a likely cross-user modification path. This is patched in version 26.06.08.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-32821
EUVD
EUVD-2026-45996

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
datacycle datacycle to 25.07.3 (inc)
datacycle datacycle 26.06.08
datacycle datacycle-core to 25.07.3|start_including=26.06.08 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in dataCycle-CORE allows authenticated API users to manipulate permissions by supplying a user_email parameter, potentially exposing collections of other users. Additionally, in V4, it enables unauthorized add_item and remove_item actions on collections if the collection ID is known, due to missing object-level authorization checks.

Detection Guidance

To detect this vulnerability, check if your dataCycle-CORE version is before 26.06.08. Review API logs for suspicious permission evaluations or collection modifications by authenticated users. Test if authenticated users can access collections via the API using different user_email parameters.

Impact Analysis

An attacker with valid API access could view or modify another user's collections, leading to unauthorized data exposure or tampering. This could result in data leaks, integrity issues, or compliance violations depending on the data involved.

Compliance Impact

This vulnerability could violate GDPR's data protection principles (e.g., unauthorized access to personal data) and HIPAA's integrity requirements (e.g., unauthorized modification of health data). Organizations using affected versions may face compliance penalties and reputational damage.

Mitigation Strategies

Immediately upgrade dataCycle-CORE to version 26.06.08 or later. Review and restrict API access permissions, especially for users with elevated privileges. Monitor API logs for unauthorized collection access or modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32821. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart