CVE-2026-32823
Received Received - Intake

Cross-Site Request Forgery in dataCycle-CORE

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through `GET` routes. Because browsers automatically send cookies on same-site top-level navigation and Rails does not apply CSRF protections to `GET`, an attacker can force a logged-in victim to modify application state by embedding a link, image, iframe, or redirect to one of these endpoints. This was confirmed on the target with a normal `Standard` account: a cross-site-style `GET` to `watch_lists/:id/add_item?thing_id=...` inserted content into a watch list with no CSRF token. Additional `GET` mutation routes exist in the codebase, including user impersonation for authorized admins and cache or translation state changes. This is patched in version 26.06.08.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-32823
EUVD
EUVD-2026-45997

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
datacycle datacycle-core to 25.07.3|start_including=26.06.08 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the dataCycle-CORE application. It occurs because the system exposes state-changing operations via GET requests, which Rails does not protect with CSRF tokens. Attackers can exploit this by tricking authenticated users into clicking malicious links, images, or redirects, forcing unintended actions like modifying watch lists or impersonating users.

Detection Guidance

To detect this vulnerability, review server logs for unusual GET requests to state-changing endpoints like watch_lists/:id/add_item or user impersonation routes. Check for repeated requests from the same user or unexpected modifications to watch lists or other data. No specific commands are provided in the context.

Impact Analysis

An attacker could manipulate your account or data without your knowledge. For example, they might add unauthorized items to your watch lists, change your user settings, or even impersonate you if you have admin privileges. This requires you to click a malicious link while logged in.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized state changes through CSRF attacks. For GDPR, it may lead to unauthorized modifications of personal data or watch lists, violating integrity and access control principles. For HIPAA, it could allow unauthorized changes to sensitive health-related data if such data is managed within the system.

Mitigation Strategies

Immediately upgrade dataCycle-CORE to version 26.06.08 or later to patch the vulnerability. If upgrading is not possible, disable or restrict access to vulnerable GET endpoints and implement CSRF protections for all state-changing requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32823. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart