CVE-2026-32824
Received Received - Intake

Open Redirect in dataCycle-CORE Prior to 26.06.08

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply `forwardToUrl` and `redirectUrl` values when triggering password reset or confirmation flows. Those values are then embedded into the outgoing email workflow without host allowlisting. This creates two related abuse paths: - password reset or confirmation links can be sent to a victim with the token already attached to an attacker-controlled `forwardToUrl` - after a legitimate password reset completes, the browser is redirected to attacker-controlled `redirectUrl` In practice, this can be used for phishing, token capture, confirmation hijacking, or steering a victim from a trusted email into an attacker domain. This is patched in version 26.06.08.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-32824
EUVD
EUVD-2026-45998

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
datacycle datacycle-core to 25.07.3|start_including=26.06.08 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in dataCycle-CORE allows a low-privileged authenticated user to manipulate password reset or confirmation flows by providing attacker-controlled redirect URLs. These URLs are embedded in emails without proper validation, enabling phishing, token theft, or redirecting users to malicious domains.

Detection Guidance

To detect this vulnerability, monitor outbound emails for password reset or confirmation links containing suspicious URLs with `forwardToUrl` or `redirectUrl` parameters. Check web server logs for unusual redirects to external domains after password reset actions. Inspect API logs for requests with these parameters from low-privileged users.

Impact Analysis

An attacker could send you a password reset link with a token pointing to their server, steal your reset token, or redirect you to a fake site after you complete a legitimate password reset. This could lead to account takeover or credential theft.

Compliance Impact

This vulnerability could lead to unauthorized access to user accounts through phishing or token theft, which may result in data breaches. Such breaches could violate GDPR's data protection requirements or HIPAA's safeguards for protected health information, potentially leading to regulatory penalties and loss of trust.

Mitigation Strategies

Immediately upgrade dataCycle-CORE to version 26.06.08 or later to patch the vulnerability. Review and restrict API user permissions to prevent low-privileged users from modifying redirect parameters. Monitor email workflows for suspicious redirect URLs in password reset or confirmation flows.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32824. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart