CVE-2026-32823

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through `GET` routes. Because browsers automatically send cookies on same-site top-level navigation and Rails does not apply CSRF protections to `GET`, an attacker can force a logged-in victim to modify application state by embedding a link, image, iframe, or redirect to one of these endpoints. This was confirmed on the target with a normal `Standard` account: a cross-site-style `GET` to `watch_lists/:id/add_item?thing_id=...` inserted content into a watch list with no CSRF token. Additional `GET` mutation routes exist in the codebase, including user impersonation for authorized admins and cache or translation state changes. This is patched in version 26.06.08.

• CWE-352

• https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-55wx-jh6w-jc57

Published

Jul 20, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32818Admidio is an open-source user management solution. In versi…6.5
• CVE-2026-32819dataCycle is a data management system for centrally storing,…4.3
• CVE-2026-3282A flaw has been found in libvips 8.19.0. This vulnerability …7.1
• CVE-2026-32820dataCycle is a data management system for centrally storing,…7.5
• CVE-2026-32821dataCycle is a data management system for centrally storing,…8.1
• CVE-2026-32822dataCycle is a data management system for centrally storing,…6.1
• CVE-2026-32824dataCycle is a data management system for centrally storing,…7.3
• CVE-2026-32825dataCycle is a data management system for centrally storing,…7.3
• CVE-2026-32828Kargo manages and automates the promotion of software artifa…4.9
• CVE-2026-32829lz4_flex is a pure Rust implementation of LZ4 compression/de…7.5
• CVE-2026-3283A vulnerability has been found in libvips 8.19.0. This issue…7.1
• CVE-2026-32833Cudy LT300 3.0 running firmware prior to version 2.5.12 cont…8.8