CVE-2026-32823

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32823", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-16T17:35:36.697Z", "datePublished": "2026-07-20T16:12:33.395Z", "dateUpdated": "2026-07-20T19:05:22.754Z"}, "containers": {"cna": {"title": "dataCycle State-Changing GET Endpoints Enable CSRF", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-55wx-jh6w-jc57", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-55wx-jh6w-jc57"}], "affected": [{"vendor": "datacycle-engine", "product": "dataCycle-CORE", "versions": [{"version": "<= 25.07.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T16:12:33.395Z"}, "descriptions": [{"lang": "en", "value": "dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through `GET` routes. Because browsers automatically send cookies on same-site top-level navigation and Rails does not apply CSRF protections to `GET`, an attacker can force a logged-in victim to modify application state by embedding a link, image, iframe, or redirect to one of these endpoints. This was confirmed on the target with a normal `Standard` account: a cross-site-style `GET` to `watch_lists/:id/add_item?thing_id=...` inserted content into a watch list with no CSRF token. Additional `GET` mutation routes exist in the codebase, including user impersonation for authorized admins and cache or\ntranslation state changes. This is patched in version 26.06.08."}], "source": {"advisory": "GHSA-55wx-jh6w-jc57", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T19:04:29.521095Z", "id": "CVE-2026-32823", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T19:05:22.754Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32823", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T19:04:29.521095Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T19:04:58.011Z"}}], "cna": {"title": "dataCycle State-Changing GET Endpoints Enable CSRF", "source": {"advisory": "GHSA-55wx-jh6w-jc57", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "datacycle-engine", "product": "dataCycle-CORE", "versions": [{"status": "affected", "version": "<= 25.07.3"}]}], "references": [{"url": "https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-55wx-jh6w-jc57", "name": "https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-55wx-jh6w-jc57", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through `GET` routes. Because browsers automatically send cookies on same-site top-level navigation and Rails does not apply CSRF protections to `GET`, an attacker can force a logged-in victim to modify application state by embedding a link, image, iframe, or redirect to one of these endpoints. This was confirmed on the target with a normal `Standard` account: a cross-site-style `GET` to `watch_lists/:id/add_item?thing_id=...` inserted content into a watch list with no CSRF token. Additional `GET` mutation routes exist in the codebase, including user impersonation for authorized admins and cache or\ntranslation state changes. This is patched in version 26.06.08."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-20T16:12:33.395Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32823", "state": "PUBLISHED", "dateUpdated": "2026-07-20T19:05:22.754Z", "dateReserved": "2026-03-16T17:35:36.697Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-20T16:12:33.395Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "dataCycle-CORE", "vendor": "datacycle-engine", "versions": [{"status": "affected", "version": "<= 25.07.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through `GET` routes. Because browsers automatically send cookies on same-site top-level navigation and Rails does not apply CSRF protections to `GET`, an attacker can force a logged-in victim to modify application state by embedding a link, image, iframe, or redirect to one of these endpoints. This was confirmed on the target with a normal `Standard` account: a cross-site-style `GET` to `watch_lists/:id/add_item?thing_id=...` inserted content into a watch list with no CSRF token. Additional `GET` mutation routes exist in the codebase, including user impersonation for authorized admins and cache or\ntranslation state changes. This is patched in version 26.06.08."}, {"lang": "es", "value": "dataCycle es un sistema de gesti\u00f3n de datos para almacenar, gestionar, buscar, encontrar y distribuir datos de forma centralizada. En dataCycle-CORE, el m\u00f3dulo que maneja el procesamiento central y las reglas del framework, antes e incluyendo la versi\u00f3n 25.07.3, la aplicaci\u00f3n expone cambios de estado del lado del servidor a trav\u00e9s de rutas \u2019GET\u2019. Debido a que los navegadores env\u00edan autom\u00e1ticamente cookies en la navegaci\u00f3n de nivel superior del mismo sitio y Rails no aplica protecciones CSRF a \u2019GET\u2019, un atacante puede forzar a una v\u00edctima que ha iniciado sesi\u00f3n a modificar el estado de la aplicaci\u00f3n incrustando un enlace, imagen, iframe o redirigiendo a uno de estos puntos finales. Esto se confirm\u00f3 en el objetivo con una cuenta \u2019Standard\u2019 normal: un \u2019GET\u2019 de estilo cross-site a \u2019watch_lists/:id/add_item?thing_id=...\u2019 insert\u00f3 contenido en una lista de seguimiento sin token CSRF. Existen rutas de mutaci\u00f3n \u2019GET\u2019 adicionales en el c\u00f3digo base, incluyendo la suplantaci\u00f3n de identidad de usuario para administradores autorizados y cambios de estado de cach\u00e9 o traducci\u00f3n. Esto est\u00e1 parcheado en la versi\u00f3n 26.06.08."}], "id": "CVE-2026-32823", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32823", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T19:04:29.521095Z", "version": "2.0.3"}}]}, "published": "2026-07-20T17:17:05.877", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-55wx-jh6w-jc57"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,25.07.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "dataCycle-CORE", "source": "cna", "vendor": "datacycle-engine"}, "product": "datacycle-core", "vendor": "datacycle-engine"}], "created": "2026-07-21T20:30:12.694378+00:00", "updated": "2026-07-30T19:15:04.765945+00:00", "vendors": ["datacycle-engine", "datacycle-engine$PRODUCT$datacycle-core"]}