# CVE-2026-32823: datacycle-engine dataCycle-CORE CSRF via state-changing GET routes

Source: https://junglewise.ai/threats/cve-2026-32823-datacycle-engine-datacycle-core-csrf-via-state-changing-get  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-32823 · Severity: medium · CVSS 4.3 · Published 2026-07-20

dataCycle-CORE, a data management system, contains a security flaw that allows unauthorized changes to system data. By tricking a logged-in user into clicking a malicious link or visiting a compromised website, an attacker can force the system to perform actions on the user's behalf, such as modifying watch lists or changing system settings. This could lead to unauthorized data manipulation or administrative changes without the user's knowledge.

Technologies: [dataCycle-Engine dataCycle-CORE](https://junglewise.ai/threats/technologies/datacycle-core). Vendors: [dataCycle-Engine](https://junglewise.ai/threats/vendors/datacycle-engine).

## Quick answers

**Is CVE-2026-32823 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32823 being exploited in the wild.

**How severe is CVE-2026-32823?** Medium severity, with a CVSS score of 4.3, published 20 July 2026.

**Which products and versions are affected?** dataCycle-Engine dataCycle-CORE <= 25.07.3.

**Is there a fix for CVE-2026-32823?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-32823 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-32823?** Check whether you run dataCycle-Engine dataCycle-CORE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The dataCycle-CORE module fails to adhere to RESTful principles by exposing server-side state changes through GET routes. Since the underlying Ruby on Rails framework does not apply CSRF protection to GET requests and browsers automatically include cookies during top-level navigation, the application is vulnerable to Cross-Site Request Forgery (CSRF). Attackers can exploit this by embedding malicious links or iframes that target endpoints such as `watch_lists/:id/add_item`. Beyond simple data insertion, the codebase contains GET mutation routes for sensitive operations including user impersonation for admins and cache/translation state modifications. The vulnerability is addressed in version 26.06.08.

## Affected products

- datacycle-engine dataCycle-CORE <= 25.07.3

## Timeline

- 2026-06-24: advisory: GitHub security advisory published
- 2026-07-20: disclosed: CVE published to NVD

## References

- [https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-55wx-jh6w-jc57](https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-55wx-jh6w-jc57)

## Related threats

- [datacycle-engine dataCycle-CORE improper restriction of authentication attempts](https://junglewise.ai/threats/cve-2026-32825-datacycle-engine-datacycle-core-improper-restriction-of)
- [datacycle-engine dataCycle-CORE open redirect in password reset flow](https://junglewise.ai/threats/cve-2026-32824-datacycle-engine-datacycle-core-open-redirect-in-password-reset)
- [datacycle-engine dataCycle-CORE improper authorization in collection API](https://junglewise.ai/threats/cve-2026-32821-datacycle-engine-datacycle-core-improper-authorization-in)
- [datacycle-engine dataCycle-CORE path traversal in markdown renderer](https://junglewise.ai/threats/cve-2026-32820-datacycle-engine-datacycle-core-path-traversal-in-markdown)
- [datacycle-engine dataCycle-CORE user enumeration in /users/search](https://junglewise.ai/threats/cve-2026-32819-datacycle-engine-datacycle-core-user-enumeration-in-users-search)