CVE-2026-119654

43th percentile - higher than 43% of all known CVEs

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.

Any authenticated user, including an external self-registered account, can gain full administrative control of the DataCap instance, leading to complete compromise of confidentiality, integrity, and availability.

Upgrade DataCap beyond 2025.1.1 if a fixed version is available, or enforce additional authorization checks on administrative endpoints. Restrict self-registration and monitor for unusual PUT requests to /api/v1/user/allocationRole.