Executive brief
dataCycle-CORE, a data management and distribution system, contains a security flaw that allows unauthorized access to private file attachments. An attacker who obtains a specific link identifier (UUID) can download files even if they are not logged in or if the link has officially expired. This could lead to the exposure of sensitive business data if email links are intercepted, forwarded, or found in server logs.
Technical details
An improper authorization vulnerability (CWE-285) exists in the dataCycle-CORE processing module. The application fails to validate authentication, link expiration status, or framework-level access rules when a direct file download request is made using a DataLink UUID. Because the mailer component embeds these direct URLs in communications, any leaked or stale link remains a valid vector for data exfiltration. Attackers can bypass the intended 'show' flow to fetch attached text files directly over the network without credentials. The issue is addressed in version 26.06.08.
Affected products
- datacycle-engine dataCycle-CORE <= 25.07.3
Timeline
- 2026-06-24: advisory: GitHub advisory published by vendor
- 2026-07-20: disclosed: CVE published to NVD