Quick answers
- Is CVE-2026-32821 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-32821 being exploited in the wild.
- How severe is CVE-2026-32821?
- High severity, with a CVSS score of 8.1, published 20 July 2026.
- Which products and versions are affected?
- dataCycle-Engine dataCycle-CORE <= 25.07.3.
- Is there a fix for CVE-2026-32821?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-32821 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-32821?
- Check whether you run dataCycle-Engine dataCycle-CORE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An improper authorization vulnerability (CWE-285) exists in the dataCycle-CORE framework's collection API. Authenticated attackers can perform user impersonation by supplying a target's email address in the `user_email` parameter, which causes the API to evaluate permissions as that target user. This flaw allows for the unauthorized disclosure of a victim's data collections. Furthermore, in version 4 (V4), the API controller lacks object-level `authorize!` checks on the `add_item` and `remove_item` routes. Once an attacker identifies a collection ID through the impersonation flaw, they can modify the contents of that collection without proper authorization. The vulnerability is reachable over the network by any user with a valid API access token. A fix is available in version 26.06.08.
Affected products
- datacycle-engine dataCycle-CORE <= 25.07.3
Timeline
- 2026-06-24: advisory: GitHub security advisory published
- 2026-07-20: disclosed: CVE published to NVD