CVE Explorer

CVE-2026-32825

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the browser login flow and the JSON login endpoint. The source code enables Devise's `:lockable` module on the user model but explicitly disables both lock and unlock strategies, and no request throttling or

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:95a3512085ab968c7e00536fe0893660f95b1ee04a34d7e45f36fe7486cc5e99

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"dataCycle-CORE","vendor":"datacycle-engine","versions":[{"status":"affected","version":"<= 25.07.3"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:29e49edda6b5aa1f143137b3f8b6f4fc00318fba3a7636ca7cfffd3adba84ced · sha256:ddf26001f8c25d40… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:29e49edda6b5aa1f143137b3f8b6f4fc00318fba3a7636ca7cfffd3adba84ced · sha256:ddf26001f8c25d40… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-307","description":"CWE-307: Improper Restriction of Excessive Authentication Attempts","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:29e49edda6b5aa1f143137b3f8b6f4fc00318fba3a7636ca7cfffd3adba84ced · sha256:ddf26001f8c25d40… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"name":"https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-736f-cqq3-ccgf","tags":["x_refsource_CONFIRM"],"url":"https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-736f-cqq3-ccgf"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:29e49edda6b5aa1f143137b3f8b6f4fc00318fba3a7636ca7cfffd3adba84ced · sha256:ddf26001f8c25d40… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer