CVE-2026-32806

Name of the Vulnerable Software and Affected Versions dataCycle-CORE versions prior to 26.06.08

Description An issue exists in the module handling core processing and framework rules where authenticated users can request arbitrary partials or helper-backed render functions via the '/remote render' endpoint. The system fails to restrict which partials can be rendered and does not apply controller-specific authorization before rendering the selected view. This allows low-privileged users to retrieve server-side rendered administrative content that is typically protected by navigation and route checks, such as PostgreSQL admin dashboard statistics.

Recommendations Update dataCycle-CORE to version 26.06.08.