DataEase CVE-2026-46684

Exploitation requires that the DataEase deployment be running the enterprise token-handling path with a valid enterprise license (the code accepts forged tokens only when licenseValid=true) - this is the concrete AT:P attack requirement and the primary limiting factor: community/unlicensed installations that do not reach this branch are not exploitable in this way. Given that condition, no authentication and no user interaction are needed (CVSS PR:N/UI:N): the attacker only needs network reachability to the application and the ability to set the X-DE-TOKEN HTTP header, then supplies a self-forged JWT with attacker-chosen uid and oid claims. The affected versions are all releases prior to 2.10.23. Limiting factors are therefore: the enterprise license must be active, the instance must be network-reachable to the attacker, and the target must be on a pre-2.10.23 build.

The signals are largely consistent and point to a genuine high priority. The CVSS 4.0 vector AV:N/AC:L/AT:P/PR:N/UI:N with full high impact to both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H) reflects a network-reachable, low-complexity, unauthenticated bypass yielding total compromise - a 9.5 Critical. The single moderating factor is AT:P (Attack Requirements present), which corresponds directly to the description's precondition that the enterprise license be active (licenseValid=true); this limits exploitation to enterprise-licensed installations rather than every community deployment, meaning targeted rather than universal exposure. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. There is no CISA KEV listing and no proof-of-concept referenced, so this is not confirmed as actively exploited; however, the vulnerability class (unsigned-JWT forgery) is trivially exploitable once understood, and a public commit diff pinpoints the fix, which typically shortens time-to-exploit. Net: treat as a real, high-urgency issue for any DataEase enterprise instance, tempered by the enterprise-license precondition.

An attacker who can reach an internet- or intranet-exposed DataEase enterprise instance crafts a JWT with the header/payload of their choosing - setting uid to an administrator's ID and oid to a target organization - and sends it in the X-DE-TOKEN header. Because the server decodes the token without checking its signature, the request is accepted as that administrator, granting full read/write control over dashboards, data sources, and user management. No credentials, prior access, or user interaction are required; only the enterprise license must be active. No public POC is referenced at time of analysis, but the fixing commit makes the flaw straightforward to reproduce.