PT-2026-61630 · Datacycle Engine · Datacycle-Core

CVE-2026-32824 · Publicado 2026-07-20 · Atualizado 2026-07-20

NVD

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply forwardToUrl and redirectUrl values when triggering password reset or confirmation flows. Those values are then embedded into the outgoing email workflow without host allowlisting. This creates two related abuse paths:

• password reset or confirmation links can be sent to a victim with the token already attached to an attacker-controlled forwardToUrl
• after a legitimate password reset completes, the browser is redirected to attacker-controlled redirectUrl

In practice, this can be used for phishing, token capture, confirmation hijacking, or steering a victim from a trusted email into an attacker domain. This is patched in version 26.06.08.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2026-32824

Produtos afetados

Datacycle-Core

Referências · 2

• https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-8jfx-wpjg-hf38 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32824 · Nota de Segurança