PT-2026-61626 · Unknown · Datacycle-Core

CVE-2026-32819 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions dataCycle-CORE versions prior to 25.07.4

Description A flaw in the core processing and framework rules module allows a Standard user to enumerate the names and email addresses of other users. This occurs via the /users/search endpoint, enabling the disclosure of internal staff addresses, full names, and the existence of guest or external test accounts, despite direct access to those user profiles being restricted.

Recommendations Update dataCycle-CORE to version 25.07.4 or later. Restrict access to the /users/search endpoint for Standard users as a temporary mitigation.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-32819

Affected Products

Datacycle-Core

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-32819 · Security Note
• https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-c4wj-q23r-mq2q · Note
• https://twitter.com/CVEnew/status/2079238898861916324 · Twitter Post