dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through "GET" routes. Because browsers automatically send cookies on same-site top-level navigation and Rails does not apply CSRF protections to "GET", an attacker can force a logged-in victim to modify application state by embedding a link, image, iframe, or redirect to one of these endpoints. This was confirmed on the target with a normal "Standard" account: a cross-site-style "GET" to "watch_lists/:id/add_item?thing_id=..." inserted content into a watch list with no CSRF token. Additional "GET" mutation routes exist in the codebase, including user impersonation for authorized admins and cache or translation state changes. This is patched in version 26.06.08.