CVE-2026-32822 is a reflected DOM XSS vulnerability in dataCycle-CORE, a core processing module of the dataCycle data management system. The vulnerability arises because the frontend toast component injects attacker-controlled HTML from flash notifications into the DOM using innerHTML without proper sanitization. This allows unauthenticated attackers to craft links that execute arbitrary scripts in the context of the affected application. The vulnerability affects versions up to and including 25.07.3 and impacts public routes, making it broadly exploitable. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the victim's browser when visiting a crafted link on public pages. This can lead to partial disclosure of information and modification of data within the user's session context. There is no direct impact on availability. The vulnerability affects the confidentiality and integrity of the application data accessible via the browser.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing input sanitization or output encoding on flash notification content to prevent injection of arbitrary HTML. Restricting or validating content that can be placed in flash notifications on public routes may mitigate risk. Monitor vendor communications for official patches or updates.