The flaw allows a malicious web site to force an authenticated user to issue GET requests that alter application state, such as adding items to a watch list or performing privileged actions. By embedding a URL in an image tag, link, or frame, the attacker can trigger server‑side changes without the user’s consent that compromises data integrity and could facilitate more advanced attacks if additional mutation routes are exposed.

The vulnerability exists in the datacycle‑engine dataCycle‑CORE module in all releases up to and including version 25.07.3. Upgrades to 26.06.08 and later contain a fix that removes state‑changing GET endpoints.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score is <1% and the issue is not listed in CISA KEV. The likely attack vector is a classic CSRF scenario: the victim’s browser automatically sends session cookies when the attacker’s malicious page loads a link or image pointing to the vulnerable GET endpoint. Successful exploitation requires the victim to be logged into dataCycle, but no additional credentials are needed beyond the user’s session.