Live › vulnerability › CVE-2026-119654
DataCap through 2025.1.1 lacks an authorization check on its administrative role and menu management APIs. An authenticated user, including a self-registered one, can call PUT /api/v1/user/allocationRole to make themselves an administrator and take full control of the instance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Self-hosted DataCap instances at 2025.1.1 or earlier. Any account that can log in, including self-registered ones, can make itself administrator. Instances reachable only by a few trusted admins with registration closed are much less exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| DataCap | vendor | <= 2025.1.1 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.
This page as .md · .json · in your agent: get_signal("CVE-2026-119654")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.