CVE-2026-32806 describes an improper authorization vulnerability (CWE-285) in dataCycle-CORE, a data management system. The /remote_render endpoint does not enforce controller-specific authorization before rendering requested partial views or helper-backed functions. As a result, any authenticated user can render arbitrary partials, including admin-only content, bypassing navigation and route-based access controls. This flaw allows low-privileged users to access sensitive administrative data. The issue affects all versions before 26.06.08, where it has been fixed.

The vulnerability allows authenticated users with low privileges to access sensitive administrative content that is normally protected by navigation and route restrictions. This can lead to unauthorized disclosure of sensitive information such as PostgreSQL admin dashboard statistics. There is no indication of integrity or availability impact. The CVSS 3.1 base score is 7.5 (high), reflecting the network attack vector, low attack complexity, no privileges required beyond authentication, no user interaction, and high confidentiality impact.

A fix is available in dataCycle-CORE version 26.06.08. Users should upgrade to this version or later to remediate the vulnerability. Until patched, restrict access to the /remote_render endpoint to trusted users only or implement additional authorization checks as a temporary mitigation. Patch status is confirmed by the vendor advisory stating the issue is fixed in 26.06.08.