CVE-2026-32823

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through GET routes. Because browsers automatically send cookies on same-site top-level navigation and Rails does not apply CSRF protections to GET, an attacker can force a logged-in victim to modify application state by embedding a link, image, iframe, or redirect to one of these endpoints. This was confirmed on the target with a normal Standard account: a cross-site-style GET to watch_lists/:id/add_item?thing_id=... inserted content into a watch list with no CSRF token. Additional GET mutation routes exist in the codebase, including user impersonation for authorized admins and cache or translation state changes. This is patched in version 26.06.08.