CVE-2026-32807
Last modified
CVE-2026-32807 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly, even if the link is expired, the caller is unauthenticated, or the normal show flow would have denied access. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly, even if the link is expired, the caller is unauthenticated, or the normal show flow would have denied access. Because the route is public and the mailer embeds the direct file URL, any leaked, forwarded, logged, or stale email link can continue to expose the attachment.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| datacycle-engine | dataCycle-CORE | <= 25.07.3 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-32807?
How severe is CVE-2026-32807?
How do I fix CVE-2026-32807?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-32792NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 …5.3
- CVE-2026-32794Improper Certificate Validation vulnerability in Apache Airf…4.8
- CVE-2026-32803Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.…3.3
- CVE-2026-32804Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain…8.1
- CVE-2026-32805Romeo gives the capability to reach high code coverage of Go…7.5
- CVE-2026-32806dataCycle is a data management system for centrally storing,…7.5
- CVE-2026-32808pyLoad is a free and open-source download manager written in…8.1
- CVE-2026-3281A vulnerability was detected in libvips 8.19.0. This affects…7.8
- CVE-2026-32810Halloy is an IRC application written in Rust. In versions on…5.5
- CVE-2026-32811Heimdall is a cloud native Identity Aware Proxy and Access C…7.5
- CVE-2026-32812Admidio is an open-source user management solution. In versi…6.8
- CVE-2026-32813Admidio is an open-source user management solution. Versions…8
Are you affected by CVE-2026-32807?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST