dataCycle-CORE Authorization Bypass Vulnerability via Remote Render Endpoint

An authorization bypass vulnerability has been identified in dataCycle-CORE versions prior to 26.06.11. The issue allows any authenticated user to request arbitrary partials or helper-backed render functions through the /remote_render endpoint. This endpoint lacks restrictions on which partials can be rendered and does not enforce controller-specific authorization before rendering the selected view. As a result, low-privileged users can access server-side rendered admin content that is typically concealed by navigation and route checks. For instance, a Standard user was able to obtain PostgreSQL admin dashboard statistics, even though the /admin route redirected away from that content.

Impact

Exploitation of this vulnerability could lead to unauthorized access to admin-only operational data, including object counts and internal table names. Such information could be valuable for reconnaissance in preparation for follow-on attacks. Additionally, depending on the available partials and injectable locals, there could be broader data leakage.

Remediation

Users can upgrade to dataCycle-CORE version 26.07.01 or later to address this vulnerability.