PT-2026-61629 · Datacycle Engine · Datacycle-Core
CVE-2026-32823
·
Publicado
2026-07-20
·
Atualizado
2026-07-20
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through
GET routes. Because browsers automatically send cookies on same-site top-level navigation and Rails does not apply CSRF protections to GET, an attacker can force a logged-in victim to modify application state by embedding a link, image, iframe, or redirect to one of these endpoints. This was confirmed on the target with a normal Standard account: a cross-site-style GET to watch lists/:id/add item?thing id=... inserted content into a watch list with no CSRF token. Additional GET mutation routes exist in the codebase, including user impersonation for authorized admins and cache or
translation state changes. This is patched in version 26.06.08.Correção
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Datacycle-Core