DataCap: Missing authorization privilege escalation (CVE-2026-119654)

DataCap through version 2025.1.1 contains a missing authorization vulnerability in administrative role and menu management APIs. An authenticated user, including one with a self-registered account, can perform unauthorized privilege escalation by sending a PUT request to the '/api/v1/user/allocationRole' endpoint to assign themselves the administrator role, resulting in full control of the instance.

Impact

Successful exploitation allows any authenticated user to gain administrative privileges, leading to full unauthorized control over the DataCap instance.

Recommendation

• Review DataCap instance access logs for any PUT requests to '/api/v1/user/allocationRole' from non-administrative user accounts.
• Audit user role assignments in the DataCap environment to identify accounts that have been granted administrative privileges unexpectedly.
• Restrict user registration to known entities to mitigate the risk of self-registered accounts exploiting the API.
• Patch DataCap to a version beyond 2025.1.1 as soon as an update is made available by the vendor.