Vulnerability · Published Jul 20, 2026 · Assigned by GitHub_M

CVE-2026-32819dataCycle User Directory Enumeration Via /users/search

Medium 4.3

In plain English

A medium-severity security flaw in dataCycle-CORE from datacycle-engine. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 80.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a Standard user can enumerate other users' names and email addresses through `/users/search`, even though direct access to those user profiles is denied. This leaks internal staff addresses, full names, and existence of guest and external test accounts.

Affected products (as reported)

Vendor	Product	Versions
datacycle-engine	dataCycle-CORE	<= 25.07.3

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-c4wj-q23r-mq2q x_refsource_CONFIRM