{"id":"CVE-2026-119654","kind":"vulnerability","aliases":["CVE-2026-119654"],"related":[],"title":"DataCap: any logged-in user can grant themselves administrator role","description":"DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.","summary":"DataCap through 2025.1.1 lacks an authorization check on its administrative role and menu management APIs. An authenticated user, including a self-registered one, can call PUT /api/v1/user/allocationRole to make themselves an administrator and take full control of the instance.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DataCap","fixed":[],"affected":"<= 2025.1.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["datacap","java","other","privilege-escalation","self-hosted"],"not_affected_if":["auth-required","registration-closed"],"how_to_check":"- Run DataCap 2025.1.1 or earlier? You are affected (check the version in the UI or the server jar/tarball name).\n- Any logged-in account can PUT /api/v1/user/allocationRole with its own userId and an admin role code; the endpoint has no @PreAuthorize. Review accounts and roles for unexpected admins.\n- The same gap is on /api/v1/role and /api/v1/menu (create/update, bind menus), so check for unfamiliar roles.\n- Restrict the instance to trusted users and check whether self-registration is on.","fix":null,"status":"open","published_at":"2026-10-30T15:16:49+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","triaged_at":"2026-10-30T15:33:12+00:00","updated_at":"2026-10-30T15:34:55+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-30T15:33:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"DataCap: any logged-in user can grant themselves administrator role","impact":"high","summary":"DataCap through 2025.1.1 lacks an authorization check on its administrative role and menu management APIs. An authenticated user, including a self-registered one, can call PUT /api/v1/user/allocationRole to make themselves an administrator and take full control of the instance.","audience":"businesses","category":"other","nicknames":[],"who_cares":["datacap","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker becomes administrator and gains full control of the instance.","analyst_note":"Sources do not state a fixed version or vendor advisory; check the DataCap vendor site for a patch and whether self-registration is default.","how_to_check":"- Check the installed DataCap version against the affected range through 2025.1.1.\n- Look for self-registration being enabled on the instance.\n- Review whether the endpoint `/api/v1/user/allocationRole` is reachable by non-admin accounts.","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","registration-closed"],"who_is_affected":"Any DataCap instance at version 2025.1.1 or earlier is exposed to a user who can log in, which includes accounts that anyone can self-register. Instances where only trusted administrators hold accounts, or where registration is closed, have a much smaller exposure. The sources do not name a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000691,"input_tokens":4137,"output_tokens":555,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources do not state a fixed version or vendor advisory; check the DataCap vendor site for a patch and whether self-registration is default.","search":"'-119654':14A,17A '-2026':13A,16A '/api/v1/user/allocationrole':55B,103C '2025.1.1':30B,70C 'account':97C 'administr':10A,37B,60B,86C,108C 'allow':77C 'api':42B,91C 'assign':105C 'attack':92C 'authent':44B,79C 'author':33B,74C 'call':53B,85C 'check':34B 'contain':71C 'control':64B,113C 'cve':12A,15A 'datacap':1A,18A,19B,28B,68C 'escal':24B,82C 'full':63B,112C 'gain':111C 'grant':8A 'host':27B 'includ':46B,93C 'instanc':67B,116C 'java':20B 'lack':31B 'log':4A 'logged-in':3A 'make':57B 'manag':41B,90C 'menu':40B,89C 'miss':73C 'one':51B 'privileg':23B,83C 'privilege-escal':22B 'put':54B,100C 'regist':50B,96C 'request':101C 'role':11A,38B,87C,109C 'self':26B,49B,95C 'self-host':25B 'self-regist':48B,94C 'send':99C 'take':62B 'user':6A,45B,80C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted DataCap instances at 2025.1.1 or earlier. Any account that can log in, including self-registered ones, can make itself administrator. Instances reachable only by a few trusted admins with registration closed are much less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119654","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119654","severity":null,"published_at":"2026-10-30T15:16:49+00:00","modified_at":"2026-10-30T15:16:49+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","fetched_at":"2026-10-30T15:31:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119654:1167","url":null,"severity":null,"published_at":"2026-10-30T15:34:55+00:00","modified_at":"2026-10-30T15:34:55+00:00","first_seen_at":"2026-10-30T15:34:55+00:00","fetched_at":"2026-10-30T15:34:55+00:00","note":"Read VulnCheck advisory and reporter write-up (static review only, no runtime test, no PoC published). Affected DataCap <= 2025.1.1 (repo devlive-community/metaforge). No vendor advisory or fixed version found; maintainer issue #969 not readable here. Nothing verified."}],"documents":[{"id":24327,"url":"https://www.vulncheck.com/advisories/datacap-through-2025.1.1-privilege-escalation-via-allocationrole-missing-authorization","title":"VulnCheck: DataCap through 2025.1.1 allocationRole missing authorization","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":24329,"url":"https://hackmd.io/@hieuPenguinnn/metaforge-datacap-allocation-role-missing-authz-privilege-escalation","title":"Reporter write-up: DataCap allocationRole missing authorization (static review, not runtime-tested)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}