CVE-2026-119654 Details

A missing authorization vulnerability has been identified in DataCap versions through 2025.1.1. This vulnerability allows any authenticated user, including self-registered accounts, to escalate privileges by accessing administrative role and menu management APIs. The issue arises because the application does not properly validate user permissions before allowing role assignments. Exploitation involves sending PUT requests to the '/api/v1/user/allocationRole' endpoint to assign oneself the administrator role, thereby gaining full control over the application instance.

The vulnerability can be addressed by adding authorization checks to the 'allocationRole' endpoint and all administrative role and menu management APIs. This includes requiring administrator privileges to access these endpoints and implementing a URL-level authorization rule for administrative routes.