Which versions of Dataease are affected by CVE-2026-45320?

DataEase dashboard versions prior to 2.10.23 contain an authenticated SQL injection vulnerability in dashboard variables that could allow an attacker to compromise sensitive data.. A patch is available.

How to fix or mitigate CVE-2026-45320?

Within 24 hours, identify all DataEase instances running versions prior to 2.10.23, isolate affected systems from untrusted networks if possible, and confirm the vendor-released patch is available for your environment. Within 7 days, schedule and begin applying patch version 2.10.23 to all affected systems, prioritizing production environments. Within 30 days, complete patching across all instances, validate the fix by verifying version numbers, and review access controls for the dashboard module to ensure least-privilege principles are enforced.

Dataease CVE-2026-45320

Q: What is the CVSS score of CVE-2026-45320?

CVE-2026-45320 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44783 HIGH

SQL Injection (CWE-89)

2026-07-15 GitHub_M

SQLi Dataease

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Remote SQLi needing only an authenticated dashboard viewer gives AV:N/AC:L/PR:L/UI:N; datasource read/write yields C:H/I:H with limited A:L, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 21:18 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 20:06 vuln.today

Analysis Generated

Jul 15, 2026 - 20:06 vuln.today

CVE Published

Jul 15, 2026 - 19:40 cve.org

HIGH 8.7

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as ${deptId} are processed by SqlparserUtils.transFilter(), whose final branch returns raw user input for non-in and non-between operators before SubstitutedSql.replace("${var}", value) splices it into dashboard SQL, allowing authenticated users who can view a dashboard to inject SQL against integrated datasources. This issue is fixed in version 2.10.23

AnalysisAI

Authenticated SQL injection in DataEase dashboard variables allows data compromise. DataEase versions prior to 2.10.23 fail to sanitize dashboard SQL variables for non-in and non-between operators,