In dataCycle-CORE, before version 25.07.3, any authenticated API caller can request the collection API to evaluate permissions on behalf of another user by supplying that user's email address. If the target user owns collections, the caller can retrieve those collections through the API. In the same module, the add_item and remove_item endpoints expose another weakness: once an attacker knows the ID of a collection they do not own, these routes allow them to add or remove items without any object‑level authorization checks. The combined fault permits a malicious user to read and modify other users’ collections, constituting an unauthorized access and integrity violation as defined by CWE-285.

The affected product is dataCycle‑CORE from datacycle‑engine. All versions up through 25.07.3 are vulnerable to the impersonation flaw. Furthermore, any release prior to 26.06.08—including 26.06.07—misses object‑level authorization on the add_item and remove_item routes, creating a cross‑user modification risk. The patch restoring proper checks was introduced in version 26.06.08 and later all releases.

The vulnerability carries a CVSS base score of 8.1 and an EPSS score of approximately 0.2 % (0.00201). It is not listed in CISA’s KEV catalog, but the low EPSS does not negate the risk: any legitimate API token—no special privileges required—suffices to exploit the flaw. Attackers can supply a valid token, inject the target user’s email, and then, if they have a known collection identifier, issue add_item or remove_item requests to alter or expose other users’ collections. The lack of object‑level checks makes the exploitation straightforward once the attacker gains authenticated access.