Executive brief
dataCycle is a data management system used for centralizing and searching corporate data. A security flaw allows any logged-in user to bypass normal access controls and view administrative dashboards and internal system statistics. This could lead to the exposure of sensitive operational data, internal database structures, and other information normally reserved for system administrators.
Technical details
An authorization bypass exists in dataCycle-CORE's /remote_render endpoint due to improper validation of requested partials. The endpoint fails to restrict which view partials can be rendered and does not apply controller-specific authorization checks before rendering. An authenticated attacker with low privileges can exploit this to request arbitrary partials or helper-backed render functions, effectively bypassing navigation and route-based access controls. This allows for the retrieval of server-side rendered admin content, such as PostgreSQL dashboard statistics and internal table names. The vulnerability is addressed in version 26.07.01 (or 26.06.08 depending on the source).
Affected products
- datacycle-engine dataCycle-CORE <= 25.07.3 (NVD); <= 26.06.11 (GitHub)
Timeline
- 2026-06-24: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: NVD publication date