DataEase CVE-2026-108824

Exploitation requires an authenticated low-privilege session (CVSS PR:L) and the ability to supply a 'calculated field' expression that reaches Utils.buildCalcField in io/dataease/engine/utils/Utils.java, where the argument is concatenated into a SQL statement. The patch indicates the shared-link/public-link path (DeLinkAop / LinkInterceptor) is also relevant, so a valid share-link token identity may suffice instead of a full account. Limiting factors: the attacker cannot act fully unauthenticated - some valid credential or share-link identity is needed - which meaningfully reduces exposure versus a pre-auth flaw; affects DataEase versions up to and including 3.0.0.

This is a moderate-priority issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the base score of 5.3 indicate network-reachable, low-complexity exploitation, but PR:L confirms the attacker must already hold valid low-privilege credentials - a fact corroborated by the independent researcher's repository explicitly titled 'DataEase-Authenticated-SQL-Injection'. Exploitation signals are mixed: publicly available exploit code exists (a gist POC) and the CVSS 4.0 exploit-maturity flag is E:P (Proof-of-Concept), but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active, widespread exploitation. The reported impact is deliberately conservative (VC:L/VI:L/VA:L), which is unusual for SQL injection (CWE-89 often yields high confidentiality impact); this likely reflects that the affected calculated-field function operates within an already-authenticated BI data context, limiting incremental gain. The source identifier is a single source (VulDB), and no independent vendor security advisory text was provided - only a merged patch PR. Net: a real, confirmed, patchable flaw worth remediating promptly, but the authentication requirement and absence of KEV/EPSS argue against treating it as a drop-everything, internet-wide crisis.

An attacker who holds a valid low-privilege DataEase account (or a shared-link identity) submits a crafted value in the 'calculated field' argument, which Utils.buildCalcField concatenates into a backend SQL query, injecting attacker-controlled SQL. A public proof-of-concept exploit is available as a gist, lowering the barrier to reproduction. The low attack complexity (AC:L) means a single crafted request over the network triggers the injection without special timing or race conditions.