The vulnerability in dataCycle-CORE allows unauthorized access to attached text files via a public route using a DataLink UUID. This bypasses normal authorization checks, including link expiration and user authentication, enabling any party with the UUID to retrieve the file. The issue affects versions before and including 25.07.3. The CVSS 3.1 score is 7.5 (high), reflecting network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No patch or official remediation guidance is currently provided, and the product is not a cloud service, so remediation depends on vendor updates.

Unauthorized parties can access sensitive attached text files without authentication or valid authorization, potentially exposing confidential data. The vulnerability does not affect data integrity or availability but has a high confidentiality impact. Because the file URLs are embedded in emails and the route is public, leaked or stale links can continue to expose attachments indefinitely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict distribution of DataLink UUIDs and avoid forwarding or exposing email links containing direct file URLs. Monitor for any vendor updates or patches addressing this authorization bypass.