CVE-2026-119654: DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization
DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated DataCap user can exploit it, including users who created their own accounts if self-registration is enabled. No administrator privileges or user interaction are required.
What access does successful exploitation provide?
An attacker can assign themselves the administrator role through the role-management API and obtain full control of the DataCap instance.
Which endpoint is used for the privilege escalation?
The described attack sends a PUT request to /api/v1/user/allocationRole to assign the administrator role.
Which versions are affected?
DataCap through version 2025.1.1 is affected.