CVE-2026-119654

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-119654 DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-119654 DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-119654 DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-119654

DataCap versions through 2025.1.1 are affected by a missing authorization vulnerability (CWE-862). This flaw allows any authenticated user , including self-registered accounts, to perform a privilege escalation attack. By sending PUT requests to the /api/v1/user/allocationRole endpoint, an attack...

EUVD-2026-114070

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

PT-2026-133584

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-119654: devlive-community DataCap: DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate…

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign...

CVE-2026-111614

DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source,...

EUVD-2026-103036

DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source,...

CVE-2026-111614 DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials

DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source,...

CVE-2026-111614

DataCap versions through 2025.1.1 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability within the BaseController.getInfoForPath method. This flaw allows authenticated users to access other users' datasources, snippets, and dashboards by providing a numeric ID. A low-privile...

CVE-2026-111614 DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials

DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source,...

CVE-2026-111614 DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials

DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source,...

CVE-2026-111614

DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source,...

PT-2026-116013

🚨 CVE-2026-111614 DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids...

CVE-2026-111614: Authorization Bypass Through User-Controlled Key

DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source,...

The Devlive Software Foundation DataCap has an authorization issue vulnerability

The Devlive Software Foundation DataCap versions 2025.1.1 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the BaseController.getInfoForPath method. Low-privilege attackers can enumerate the auto-incrementing IDs of source...

Security Bulletin: Security vulnerability in IBM Datacap

Summary This vulnerability, CVE-2026-49844, is addressed in IBM Datacap version 9.1.9 Interim Fix 009. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not...

Security Bulletin: Multiple Vulnerabilities in IBM Datacap

Summary Multiple vulnerabilities were addressed in IBM Datacap version 9.1.10 released on December 19, 2025 and IBM Datacap version 9.1.9 Interim Fix 008 released on June 15, 2026 Vulnerability Details CVEID:CVE-2022-23302 DESCRIPTION: JMSSink in all versions of Log4j 1.x is vulnerable to...