SZB-f682eaee41
EUVD-2026-114070 reports DataCap privilege escalation via admin APIs
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- devlive-community
- Product
- DataCap
- First seen
Summary
The EUVD entry, shared on Mastodon, says DataCap through 2025.1.1 has a missing authorization flaw that lets any authenticated user, including self-registered accounts, escalate privileges through administrative role and menu APIs. It assigns a CVSS v3.1 score of 8.7.
If you use devlive-community
Check devlive-community for a fixed DataCap release and upgrade past 2025.1.1
Review accounts for unexpected admin roles or menu changes
Disable open self-registration until patched
What the sources say 1
· Mastodon: “DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs.” Source