HIGH 8.7 NVD
CVE-2026-119654
DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role
DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.
References
- https://github.com/devlive-community/metaforge
- https://github.com/devlive-community/metaforge/blob/2025.1.1/core/datacap-security/src/mai
- https://github.com/devlive-community/metaforge/blob/2025.1.1/core/datacap-server/src/main/
- https://github.com/devlive-community/metaforge/blob/2025.1.1/core/datacap-server/src/main/
- https://github.com/devlive-community/metaforge/blob/2025.1.1/core/datacap-service/src/main
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-10-30 via NVD.
vulnfeed aggregates 17712 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.