CVE-2026-32825
dataCycle No Brute-Force Protection On Web And API Login Endpoints
Description
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the browser login flow and the JSON login endpoint. The source code enables Devise's `:lockable` module on the user model but explicitly disables both lock and unlock strategies, and no request throttling or rate-limiting layer was identified in the Rails code. This creates a direct online password-guessing risk: - valid user accounts can be attacked continuously without temporary lockout - the same weakness is reachable through both `/users/sign_in` and `/api/v4/auth/login` - successful guessing yields a normal session cookie in the HTML flow or a fresh JWT in the API flow - the API endpoint is especially attractive for automation because it requires no CSRF token This has been patched in version 26.06.08.
INFO
Published Date :
July 20, 2026, 5:17 p.m.
Last Modified :
Oct. 24, 2026, 8:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update dataCycle-CORE to version 26.06.08 or later.
- Implement rate-limiting for login attempts.
- Enable account lockout after multiple failed logins.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-32825.
| URL | Resource |
|---|---|
| https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-736f-cqq3-ccgf |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-32825 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-32825
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-32825 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-32825 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Added Translation Title: dataCycle-CORE de datacycle-engine, Description: dataCycle es un sistema de gestión de datos para almacenar, gestionar, buscar, encontrar y distribuir datos de forma centralizada. En dataCycle-CORE, el módulo que maneja el procesamiento central y las reglas del framework, antes e incluyendo la versión 25.07.3, la aplicación acepta intentos ilimitados de contraseña tanto contra el flujo de inicio de sesión del navegador como contra el endpoint de inicio de sesión JSON. El código fuente habilita el módulo ’:lockable’ de Devise en el modelo de usuario pero deshabilita explícitamente ambas estrategias de bloqueo y desbloqueo, y no se identificó ninguna capa de limitación de solicitudes o de tasa en el código de Rails. Esto crea un riesgo directo de adivinación de contraseñas en línea: - las cuentas de usuario válidas pueden ser atacadas continuamente sin bloqueo temporal - la misma debilidad es accesible tanto a través de “/users/sign_in” como de “/api/v4/auth/login” - la adivinación exitosa produce una cookie de sesión normal en el flujo HTML o un JWT nuevo en el flujo de la API - el endpoint de la API es especialmente atractivo para la automatización porque no requiere token CSRF Esto ha sido parcheado en la versión 26.06.08. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 20, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-32825', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-07-20T18:06:20.638881Z'} -
New CVE Received by [email protected]
Jul. 20, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'datacycle-engine', 'product': 'dataCycle-CORE', 'versions': [{'status': 'affected', 'version': '<= 25.07.3'}]}] Added Description dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the browser login flow and the JSON login endpoint. The source code enables Devise's `:lockable` module on the user model but explicitly disables both lock and unlock strategies, and no request throttling or rate-limiting layer was identified in the Rails code. This creates a direct online password-guessing risk: - valid user accounts can be attacked continuously without temporary lockout - the same weakness is reachable through both `/users/sign_in` and `/api/v4/auth/login` - successful guessing yields a normal session cookie in the HTML flow or a fresh JWT in the API flow - the API endpoint is especially attractive for automation because it requires no CSRF token This has been patched in version 26.06.08. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N Added CWE CWE-307 Added Reference https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-736f-cqq3-ccgf