Executive brief
dataCycle-CORE, a data management system, contains a security flaw that allows unauthorized changes to system data. By tricking a logged-in user into clicking a malicious link or visiting a compromised website, an attacker can force the system to perform actions on the user's behalf, such as modifying watch lists or changing system settings. This could lead to unauthorized data manipulation or administrative changes without the user's knowledge.
Technical details
The dataCycle-CORE module fails to adhere to RESTful principles by exposing server-side state changes through GET routes. Since the underlying Ruby on Rails framework does not apply CSRF protection to GET requests and browsers automatically include cookies during top-level navigation, the application is vulnerable to Cross-Site Request Forgery (CSRF). Attackers can exploit this by embedding malicious links or iframes that target endpoints such as `watch_lists/:id/add_item`. Beyond simple data insertion, the codebase contains GET mutation routes for sensitive operations including user impersonation for admins and cache/translation state modifications. The vulnerability is addressed in version 26.06.08.
Affected products
- datacycle-engine dataCycle-CORE <= 25.07.3
Timeline
- 2026-06-24: advisory: GitHub security advisory published
- 2026-07-20: disclosed: CVE published to NVD