CVE-2026-32807

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32807", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-16T17:35:36.695Z", "datePublished": "2026-07-20T15:31:30.999Z", "dateUpdated": "2026-07-20T16:14:09.733Z"}, "containers": {"cna": {"title": "dataCycle Public DataLink Text File Download Ignores Validity And Authorization", "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-gj99-3h7x-v4rv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-gj99-3h7x-v4rv"}], "affected": [{"vendor": "datacycle-engine", "product": "dataCycle-CORE", "versions": [{"version": "<= 25.07.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T15:31:30.999Z"}, "descriptions": [{"lang": "en", "value": "dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly, even if the link is expired, the caller is unauthenticated, or the normal show flow would have denied access. Because the route is public and the mailer embeds the direct file URL, any leaked, forwarded, logged, or stale email link can continue to expose the attachment."}], "source": {"advisory": "GHSA-gj99-3h7x-v4rv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T16:13:40.642376Z", "id": "CVE-2026-32807", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T16:14:09.733Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32807", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T16:13:40.642376Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T16:14:05.678Z"}}], "cna": {"title": "dataCycle Public DataLink Text File Download Ignores Validity And Authorization", "source": {"advisory": "GHSA-gj99-3h7x-v4rv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "datacycle-engine", "product": "dataCycle-CORE", "versions": [{"status": "affected", "version": "<= 25.07.3"}]}], "references": [{"url": "https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-gj99-3h7x-v4rv", "name": "https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-gj99-3h7x-v4rv", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly, even if the link is expired, the caller is unauthenticated, or the normal show flow would have denied access. Because the route is public and the mailer embeds the direct file URL, any leaked, forwarded, logged, or stale email link can continue to expose the attachment."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285: Improper Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T15:31:30.999Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32807", "state": "PUBLISHED", "dateUpdated": "2026-07-20T16:14:09.733Z", "dateReserved": "2026-03-16T17:35:36.695Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-20T15:31:30.999Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dataCycle-CORE", "vendor": "datacycle-engine", "versions": [{"status": "affected", "version": "<= 25.07.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly, even if the link is expired, the caller is unauthenticated, or the normal show flow would have denied access. Because the route is public and the mailer embeds the direct file URL, any leaked, forwarded, logged, or stale email link can continue to expose the attachment."}, {"lang": "es", "value": "dataCycle es un sistema de gesti\u00f3n de datos para almacenar, gestionar, buscar, encontrar y distribuir datos de forma centralizada. En dataCycle-CORE, el m\u00f3dulo que gestiona el procesamiento central y las reglas del framework, antes e incluyendo la versi\u00f3n 25.07.3, cualquier persona con un UUID de DataLink puede obtener el archivo de texto adjunto directamente, incluso si el enlace ha caducado, el solicitante no est\u00e1 autenticado o el flujo de visualizaci\u00f3n normal habr\u00eda denegado el acceso. Debido a que la ruta es p\u00fablica y el sistema de correo incrusta la URL directa del archivo, cualquier enlace de correo electr\u00f3nico filtrado, reenviado, registrado u obsoleto puede seguir exponiendo el archivo adjunto."}], "id": "CVE-2026-32807", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32807", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T16:13:40.642376Z", "version": "2.0.3"}}]}, "published": "2026-07-20T16:16:57.963", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-gj99-3h7x-v4rv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,25.07.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "dataCycle-CORE", "source": "cna", "vendor": "datacycle-engine"}, "product": "datacycle-core", "vendor": "datacycle-engine"}], "created": "2026-07-21T20:45:03.260310+00:00", "updated": "2026-07-30T19:15:04.773738+00:00", "vendors": ["datacycle-engine", "datacycle-engine$PRODUCT$datacycle-core"]}