CVE-2026-32819 describes an improper authorization vulnerability in dataCycle-CORE, a core processing and framework rules module of the dataCycle data management system. In versions up to and including 25.07.3, a Standard user can exploit the /users/search API endpoint to enumerate usernames and email addresses of other users, including internal staff and guest accounts, even though direct profile access is restricted. This information disclosure vulnerability is classified under CWE-285 and has a CVSS v3.1 base score of 4.3 (medium severity). No official patch or remediation level has been provided by the vendor as of the published date.

The vulnerability allows unauthorized enumeration of user names and email addresses by Standard users, leaking internal staff contact details and revealing the existence of guest and external test accounts. This information disclosure could facilitate targeted phishing or social engineering attacks but does not directly impact system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Standard user access to the /users/search endpoint or implement additional access controls to prevent unauthorized user enumeration.