Executive brief
dataCycle-CORE, a data management system used for centralizing and distributing corporate data, contains a security flaw that allows authenticated users to impersonate others. By providing a different user's email address to the system's API, an attacker can view, add, or remove items from data collections belonging to other employees. This could lead to the unauthorized exposure of sensitive business information or the malicious modification of managed data.
Technical details
An improper authorization vulnerability (CWE-285) exists in the dataCycle-CORE framework's collection API. Authenticated attackers can perform user impersonation by supplying a target's email address in the `user_email` parameter, which causes the API to evaluate permissions as that target user. This flaw allows for the unauthorized disclosure of a victim's data collections. Furthermore, in version 4 (V4), the API controller lacks object-level `authorize!` checks on the `add_item` and `remove_item` routes. Once an attacker identifies a collection ID through the impersonation flaw, they can modify the contents of that collection without proper authorization. The vulnerability is reachable over the network by any user with a valid API access token. A fix is available in version 26.06.08.
Affected products
- datacycle-engine dataCycle-CORE <= 25.07.3
Timeline
- 2026-06-24: advisory: GitHub security advisory published
- 2026-07-20: disclosed: CVE published to NVD