CVE-2026-32807
dataCycle Public DataLink Text File Download Ignores Validity And Authorization
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly, even if the link is expired, the caller is unauthenticated, or the normal show flow would have denied access. Because the route is public and the mailer embeds the direct file URL, any leaked, forwarded, logged, or stale email link can continue to expose the attachment.
| CWE | CWE-285 |
| Vendor | datacycle-engine |
| Product | datacycle-core |
| Published | Jul 20, 2026 |
| Last Updated | Jul 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for datacycle-engine datacycle-core
Be the first to know when new high vulnerabilities affecting datacycle-engine datacycle-core are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
datacycle-engine / dataCycle-CORE
<= 25.07.3