PT-2026-133584
CVE-2026-119654
·
Published
2026-10-30
·
Updated
2026-10-30
Description by
CVSS 3.1
8.8
HighMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾