Which versions of DataEase are affected by CVE-2026-46684?

DataEase versions prior to 2.10.23 contain a critical authentication bypass allowing unauthenticated remote attackers to impersonate any user, including administrators, through forged JWT tokens in…. A patch is available.

How to fix or mitigate CVE-2026-46684?

Within 24 hours, audit all DataEase access logs and active user sessions to identify unauthorized access patterns and document the business criticality of affected instances. Within 7 days, implement network isolation of DataEase from production systems or enforce compensating controls including firewall rules restricting access to known administrators, reverse-proxy authentication enforcement, and comprehensive event logging on all authentication and data queries. Within 30 days, monitor vendor security advisories for a patch release and plan staged upgrades to DataEase version 2.10.23 or later, beginning with non-production environments and progressing to production only after validation testing confirms no regression in dependent applications.

DataEase CVE-2026-46684

Q: What is the CVSS score of CVE-2026-46684?

CVE-2026-46684 has a CVSS 4.0 base score of 9.5 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-44785 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-07-15 GitHub_M

Information Disclosure Jwt Attack Dataease

9.5

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.5 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.0 CRITICAL

Network, unauthenticated JWT forgery (PR:N) but gated on an active enterprise license (AC:H); admin impersonation crosses an authorization boundary (S:C) with full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 21:18 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 20:07 vuln.today

Analysis Generated

Jul 15, 2026 - 20:07 vuln.today

CVE Published

Jul 15, 2026 - 19:41 cve.org

CRITICAL 9.5

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByToken(token) uses JWT.decode() without signature verification, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. This issue is fixed in version 2.10.23.

AnalysisAI

Authentication bypass via forged JWTs in DataEase, an open-source data visualization and BI tool, allows remote unauthenticated attackers to impersonate any user (including administrators) in enterprise deployments before version 2.10.23. The enterprise TokenFilter passes attacker-supplied X-DE-TOKEN values to a validator that checks only token presence and length, then decodes the JWT without verifying its signature, so tokens with a chosen uid and oid are accepted whenever the enterprise license is valid (licenseValid=true). CVSS 4.0 rates this 9.5 (Critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The flaw is a classic JSON Web Token signature-verification failure, mapped to CWE-347 (Improper Verification of Cryptographic Signature). In the vulnerable code path, CommunityTokenFilter/TokenFilter#doFilter() extracts the X-DE-TOKEN header and calls TokenUtils.validate(), which performs only superficial checks (token non-null and of sufficient length). The token is then handed to userBOByToken(), which invokes JWT.decode() - a routine that parses and base64-decodes the token payload but performs NO cryptographic signature check. Because the identity claims uid (user ID) and oid (organization ID) are read straight from the unverified payload, an attacker can hand-craft a JWT asserting any identity. The fix in 2.10.23 introduces a server-side token secret (SubstituleLoginConfig.getTokenSecret(), a randomly generated UUID-based secret persisted to the substitute-login config file) and signs/verifies tokens with it, replacing the prior weak MD5-of-password scheme. CPE cpe:2.3:a:dataease:dataease identifies the affected product; the DataEase enterprise/substitute-login subsystem (io.dataease.auth) is the specific component involved.

RemediationAI

Upgrade to the vendor-released patch: DataEase 2.10.23, which adds a persisted server-side token secret and signs/verifies JWTs with it (release: https://github.com/dataease/dataease/releases/tag/v2.10.23; advisory: https://github.com/dataease/dataease/security/advisories/GHSA-gp6v-f7mm-458v). Because the vulnerability lives in core token validation, there is no clean in-app configuration toggle to disable it; if immediate upgrade is not possible, compensating controls are to restrict network exposure of the DataEase instance - place it behind a VPN or IP allow-list and block untrusted access to the application port so the X-DE-TOKEN header cannot be reached by outsiders - and, if operationally acceptable, deactivate the enterprise license so the licenseValid=true branch that gates forged-token acceptance is not taken, accepting the trade-off of losing enterprise functionality. Additionally, a reverse proxy or WAF rule can strip or validate inbound X-DE-TOKEN headers, though this is fragile and does not fix the underlying signature-verification gap. Rotate credentials and review admin activity after patching, since prior forged-token access would not appear as a normal authentication event.