DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization
Affects DataCap through release 2025.1.1 (tested on 2025.1.1), where any authenticated user can gain the administrator role. CVSS rates it 8.7 (high). No fixed release is listed in the checked facts.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: total
Summary
DataCap, a web-based application, is affected by this vulnerability. Any logged-in user, including accounts that anyone can self-register, can gain administrator privileges and full control of the application instance by abusing an unprotected role-assignment feature.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- devlive-community DataCap
through 2025.1.1
References 8
GitHub · devlive-community/metaforge
- Issue #969
- core/datacap-server/src/main/java/io/edurt/datacap/server/controller/user/UserController.java · L97-L108
- core/datacap-service/src/main/java/io/edurt/datacap/service/service/impl/UserServiceImpl.java · L104-L137
- core/datacap-server/src/main/java/io/edurt/datacap/server/controller/admin/RoleController.java · L34-L52
- core/datacap-security/src/main/java/io/edurt/datacap/security/SecurityConfigure.java · L63-L78
- Repository
Questions about CVE-2026-119654
What does this mean?
An authenticated user can grant themselves or other users the administrator role, then log in again to receive administrator authorities and full administrative control of the instance. The flaw is a missing authorization check on the allocationRole function.Source: github.com
Am I affected, and how do I check?
The listed range runs from the first release through 2025.1.1, and the tested version was release 2025.1.1. To check an installation, look up the DataCap release it runs and compare it against that range.Source: github.com
What should I do about it?
The checked facts name no fixed release, so no upgrade target can be given. Check the DataCap project for a release newer than 2025.1.1 and update when one that addresses this flaw is published.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The checked facts list no workaround. Because the flaw requires an authenticated account, limiting which users hold login accounts on the instance reduces exposure until a fix is available.Source: github.com