Which versions of DataEase are affected by CVE-2026-40900?

DataEase versions 2.10.20 and earlier contain an authenticated SQL injection vulnerability enabling attackers with datasource credentials to read and modify any connected database, affecting…. A patch is available.

How to fix or mitigate CVE-2026-40900?

Within 24 hours, create an inventory of all DataEase deployments in your environment, document their versions, and map which production databases are connected to each instance. Within 7 days, upgrade all affected installations to DataEase version 2.10.21 or later and review who has access to datasource credentials, removing any unnecessary account sharing. Within 30 days, audit your connected database transaction logs for unusual SQL patterns (UPDATE/DELETE/INSERT statements, or multi-statement executions) that may indicate exploitation attempts, and rotate credentials for any datasource accounts that may have been compromised.

DataEase CVE-2026-40900

Q: What is the CVSS score of CVE-2026-40900?

CVE-2026-40900 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23308 HIGH

SQL Injection (CWE-89)

2026-04-16 GitHub_M

SQLi Dataease

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network endpoint, low complexity, but requires an authenticated user with datasource access (PR:L); stacked queries give high database confidentiality and integrity impact with limited availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:23 vuln.today

Analysis Generated

Jul 24, 2026 - 07:23 vuln.today

Patch released

Apr 20, 2026 - 16:46 nvd

Patch available

Apr 16, 2026 - 22:46 EUVD

CVSS changed

Apr 16, 2026 - 21:22 NVD

8.7 (HIGH)

EUVD ID Assigned

Apr 16, 2026 - 21:15 euvd

EUVD-2026-23308

CVE Published

Apr 16, 2026 - 20:53 nvd

HIGH 8.7

DescriptionGitHub Advisory

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /de2api/datasetData/previewSql endpoint. The user-supplied SQL is wrapped in a subquery without validation that the input is a single SELECT statement. Combined with the JDBC blocklist bypass that allows enabling allowMultiQueries=true, an attacker can break out of the subquery and execute arbitrary stacked SQL statements, including UPDATE and other write operations, against the connected database. An authenticated attacker with access to valid datasource credentials can achieve full read and write access to the underlying database. This issue has been fixed in version 2.10.21.

AnalysisAI

Authenticated SQL injection in DataEase (open-source BI/data-visualization platform) versions 2.10.20 and below lets an attacker with valid datasource credentials achieve full read and write access to a connected database via the /de2api/datasetData/previewSql endpoint. User-supplied SQL is wrapped in a subquery without enforcing a single SELECT, and a JDBC blocklist bypass re-enables allowMultiQueries=true, allowing stacked statements such as UPDATE. Publicly available exploit code exists (SSVC: PoC), but EPSS is only 0.03% and it is not in CISA KEV, so no active exploitation is confirmed. Fixed in 2.10.21.

Technical ContextAI

DataEase is a Java/Spring-based open-source business-intelligence and data-visualization platform (CPE cpe:2.3:a:dataease:dataease) that connects to user-configured backend databases over JDBC and offers an SQL-dataset preview feature. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the previewSql endpoint embeds raw user SQL inside a wrapping subquery ('SELECT ... FROM (<user sql>)') without verifying the input is a single SELECT. The severity is amplified by a JDBC connection-string blocklist bypass that lets the attacker set allowMultiQueries=true on the underlying MySQL/MariaDB JDBC driver, which enables multiple semicolon-separated statements per query - turning a read-only preview into an arbitrary stacked-query execution primitive that can break out of the subquery and run write operations.

RemediationAI

Vendor-released patch: upgrade to DataEase 2.10.21 or later, which fixes the stacked-query SQL injection (release notes: https://github.com/dataease/dataease/releases/tag/v2.10.21; advisory: https://github.com/dataease/dataease/security/advisories/GHSA-vqxf-84ph-j3vx). Note that 2.10.21 introduces a breaking change - frontend user-info credentials gain a 'de_v2_' prefix (e.g. user.token becomes de_v2_user.token), which affects integrations such as SQLBot, so plan integration updates before upgrading. If immediate patching is impossible, compensating controls include restricting who holds valid datasource credentials and access to the SQL-dataset/previewSql feature (limit to trusted admins, since exploitation requires authenticated access), placing the DataEase management interface behind a VPN or IP allowlist to remove network reachability for untrusted users, and configuring the backend database accounts used by DataEase datasources with least-privilege, read-only grants so a successful injection cannot perform UPDATE/write operations - the trade-off being that read-only accounts may break legitimate write-back or ETL features that rely on those datasources. This release also bundles fixes for several other SQL-injection CVEs (CVE-2026-33082/33083/33084/33121/33122/33207), an XXE and arbitrary file read, so upgrading is strongly recommended over piecemeal mitigation.