Cpe:2.3:a:datacap:datacap:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3adatacapdatacap/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 15:31:18 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDataCap: Missing authorization privilege escalation (CVE-2026-119654)https://feed.craftedsignal.io/briefs/2026-10-datacap-auth-bypass/Fri, 30 Oct 2026 15:31:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-datacap-auth-bypass/DataCap versions 2025.1.1 and earlier are vulnerable to a missing authorization flaw that allows authenticated users to escalate privileges via administrative API calls.DataCap through version 2025.1.1 contains a missing authorization vulnerability in administrative role and menu management APIs. An authenticated user, including one with a self-registered account, can perform unauthorized privilege escalation by sending a PUT request to the '/api/v1/user/allocationRole' endpoint to assign themselves the administrator role, resulting in full control of the instance.

Impact

Successful exploitation allows any authenticated user to gain administrative privileges, leading to full unauthorized control over the DataCap instance.

Recommendation

  • Review DataCap instance access logs for any PUT requests to '/api/v1/user/allocationRole' from non-administrative user accounts.
  • Audit user role assignments in the DataCap environment to identify accounts that have been granted administrative privileges unexpectedly.
  • Restrict user registration to known entities to mitigate the risk of self-registered accounts exploiting the API.
  • Patch DataCap to a version beyond 2025.1.1 as soon as an update is made available by the vendor.
]]>highadvisory