CVE-2026-32825
Received Received - Intake

Brute Force Vulnerability in dataCycle-CORE

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the browser login flow and the JSON login endpoint. The source code enables Devise's `:lockable` module on the user model but explicitly disables both lock and unlock strategies, and no request throttling or rate-limiting layer was identified in the Rails code. This creates a direct online password-guessing risk: - valid user accounts can be attacked continuously without temporary lockout - the same weakness is reachable through both `/users/sign_in` and `/api/v4/auth/login` - successful guessing yields a normal session cookie in the HTML flow or a fresh JWT in the API flow - the API endpoint is especially attractive for automation because it requires no CSRF token This has been patched in version 26.06.08.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-32825
EUVD
EUVD-2026-45999

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
datacyle datacycle 25.07.3
datacyle datacycle to 25.07.3 (inc)
datacyle datacycle 26.06.08
datacycle datacycle-core to 25.07.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an online password-guessing risk in dataCycle-CORE versions before 25.07.3. The application allows unlimited attempts to guess passwords through both web and API login endpoints without any rate-limiting or lockout mechanisms. The Devise :lockable module is enabled but its security features are disabled, making valid accounts vulnerable to continuous brute-force attacks.

Detection Guidance

To detect this vulnerability, monitor login attempts on both the web interface (/users/sign_in) and API endpoint (/api/v4/auth/login) for excessive failed password attempts. Check for repeated access attempts without rate-limiting or account lockouts. Use tools like Burp Suite or OWASP ZAP to simulate brute-force attacks and observe if the system allows unlimited guesses.

Impact Analysis

An attacker could exploit this to gain unauthorized access to user accounts by guessing passwords. Successful attacks could lead to data breaches, unauthorized data access, or further lateral movement within the system. Both web and API login flows are affected, with the API being more susceptible due to the lack of CSRF token requirements.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches resulting from brute-force attacks.

Mitigation Strategies

Immediately update dataCycle-CORE to version 26.06.08 or later to patch the vulnerability. Implement rate-limiting or account lockout mechanisms on both login endpoints. Disable the Devise :lockable module if not needed or configure proper lock/unlock strategies. Add request throttling in the Rails application to prevent brute-force attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32825. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart