CVE-2026-32825— dataCycle No Brute-Force Protection On Web And API Login Endpoints
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| datacycle-engine | dataCycle-CORE | <= 25.07.3 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-32825
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
dataCycle No Brute-Force Protection On Web And API Login Endpoints
Source: CVE Program / CVE List V5
Vulnerability Description
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the browser login flow and the JSON login endpoint. The source code enables Devise's `:lockable` module on the user model but explicitly disables both lock and unlock strategies, and no request throttling or rate-limiting layer was identified in the Rails code. This creates a direct online password-guessing risk: - valid user accounts can be attacked continuously without temporary lockout - the same weakness is reachable through both `/users/sign_in` and `/api/v4/auth/login` - successful guessing yields a normal session cookie in the HTML flow or a fresh JWT in the API flow - the API endpoint is especially attractive for automation because it requires no CSRF token This has been patched in version 26.06.08.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
过多认证尝试的限制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
dataCycle CORE 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
dataCycle dataCycle CORE是奥地利dataCycle组织的一个数据管理系统的核心处理与框架模块。 dataCycle-CORE 25.07.3及之前版本存在授权问题漏洞，该漏洞源于未限制密码猜测次数，可能导致未经身份验证的攻击者进行密码猜测攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| datacycle-engine | dataCycle-CORE | <= 25.07.3 | - |
II. Public POCs for CVE-2026-32825
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 7595 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-32825
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-32825 (1)
Same Patch Batch · datacycle-engine · 2026-07-20 · 9 CVEs total
| CVE-2026-32821 | 8.1 HIGH | API Collection Impersonation Via user_email And Missing Object- Level Authorization |
| CVE-2026-32807 | 7.5 HIGH | dataCycle Public DataLink Text File Download Ignores Validity And Authorization |
| CVE-2026-32820 | 7.5 HIGH | dataCycle Public Markdown Path Traversal Via /docs/*path |
| CVE-2026-32806 | 7.5 HIGH | dataCycle Authorization Bypass Via /remote_render |
| CVE-2026-32824 | 7.3 HIGH | dataCycle User API Password Reset And Confirmation Flows Trust Attacker- Controlled Redire |
| CVE-2026-32822 | 6.1 MEDIUM | dataCycle Unauthenticated Reflected DOM XSS Via flash[...] On Public Pages |
| CVE-2026-32823 | 4.3 MEDIUM | dataCycle State-Changing GET Endpoints Enable CSRF |
| CVE-2026-32819 | 4.3 MEDIUM | dataCycle User Directory Enumeration Via /users/search |
IV. Related Vulnerabilities
Same product: dataCycle-CORE
- CVE-2026-32824
dataCycle User API Password Reset And Confirmation Flows Tru - CVE-2026-32823
dataCycle State-Changing GET Endpoints Enable CSRF - CVE-2026-32821
API Collection Impersonation Via user_email And Missing Obje - CVE-2026-32806
dataCycle Authorization Bypass Via /remote_render - CVE-2026-32820
dataCycle Public Markdown Path Traversal Via /docs/*path
Same vendor: datacycle-engine
- CVE-2026-32824
dataCycle User API Password Reset And Confirmation Flows Tru - CVE-2026-32823
dataCycle State-Changing GET Endpoints Enable CSRF - CVE-2026-32821
API Collection Impersonation Via user_email And Missing Obje - CVE-2026-32806
dataCycle Authorization Bypass Via /remote_render - CVE-2026-32820
dataCycle Public Markdown Path Traversal Via /docs/*path
Same weakness: CWE-307
- CVE-2026-15144
@fastify/rate-limit vulnerable to rate-limit bypass via IPv6 - CVE-2026-16347
Improper restriction of excessive authentication attempts in - CVE-2026-65894
Improper Authentication Vulnerability in CP PLUS EZ-P21 IP C - CVE-2026-8285
OTP Bypass in Universal Sotware's FlexCity - CVE-2026-62220
OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass
V. Comments for CVE-2026-32825
No comments yet