Is CVE-2026-119654 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-119654?

CVE-2026-119654 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-119654

Description

DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.