Which versions of DataEase are affected by CVE-2026-50030?

DataEase versions prior to 2.10.23 allow authenticated users to bypass access controls and read arbitrary data from connected databases.. A patch is available.

How to fix or mitigate CVE-2026-50030?

Within 24 hours, enumerate all DataEase instances in your environment and verify versions; flag any instances running versions before 2.10.23 as critical priority. Within 7 days, restrict network-level access to datasources from DataEase servers using firewall rules, enable audit logging on all database connections, and review user role permissions to apply principle of least privilege on datasource credentials. Within 30 days, upgrade all DataEase deployments to version 2.10.23 or later, validate that unrestricted query access has been disabled, and conduct a retrospective audit of datasource access logs for any suspicious query patterns dating back 90 days.

DataEase CVE-2026-50030

Q: What is the CVSS score of CVE-2026-50030?

CVE-2026-50030 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44778 HIGH

SQL Injection (CWE-89)

2026-07-15 GitHub_M

SQLi Dataease

7.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable preview endpoint with low complexity but requires a low-privilege authenticated account (PR:L); read-only data disclosure gives C:H with I:N and A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 15, 2026 - 21:18 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 20:03 vuln.today

Analysis Generated

Jul 15, 2026 - 20:03 vuln.today

CVE Published

Jul 15, 2026 - 19:24 cve.org

HIGH 7.1

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetDataApi.previewSql/previewSqlCheck through /de2api/datasetData/previewSql, accepts PreviewSqlDTO.sql, PreviewSqlDTO.datasourceId, and PreviewSqlDTO.isCross, then DatasetDataManage.previewSql stores decoded SQL in datasourceRequest.query and CalciteProvider.fetchResultField executes it with prepareStatement(...).executeQuery(), allowing arbitrary readable datasource tables to be queried and returned in preview responses. This issue is fixed in version 2.10.23.

AnalysisAI

Arbitrary SQL read access in DataEase before 2.10.23 lets authenticated users abuse the SQL preview feature (/de2api/datasetData/previewSql) to run attacker-supplied queries against any configured datasource. Because DatasetDataManage.previewSql passes the decoded PreviewSqlDTO.sql straight into datasourceRequest.query and CalciteProvider.fetchResultField executes it via prepareStatement().executeQuery(), an attacker can read any table the datasource account can access and receive the rows in the preview response. No public exploit identified at time of analysis, but the fix commit and advisory are public, making the flaw easy to reverse-engineer.

Technical ContextAI

DataEase is an open-source data visualization and business intelligence platform (io.dataease) that connects to external SQL datasources and lets users build datasets. The vulnerable path is the SQL preview capability: the DatasetDataApi.previewSql / previewSqlCheck controller accepts a PreviewSqlDTO containing raw sql, a datasourceId, and an isCross flag, and DatasetDataManage.previewSql stores the decoded SQL in datasourceRequest.query, which CalciteProvider.fetchResultField then runs through JDBC prepareStatement(...).executeQuery(). This is a classic CWE-89 (SQL Injection / improper neutralization of SQL) issue rooted in trusting client-supplied SQL and variable default values rather than parameterizing them - the fix in DeSqlparserUtils/SqlparserUtils replaces raw default-value string concatenation with a buildPreparedSqlFragmentForDefaultValue path that binds values as prepared-statement parameters. The single CPE cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:* covers all versions prior to 2.10.23.

RemediationAI

Vendor-released patch: upgrade to DataEase 2.10.23, which is the fixed release (https://github.com/dataease/dataease/releases/tag/v2.10.23); the corrective change is in commit 22930a493d900fe3d8084b3dd4c0125abdb2a847, which parameterizes SQL-variable default values via prepared statements in DeSqlparserUtils and SqlparserUtils. Review the advisory GHSA-j4v5-5gcx-cvfc for details. If immediate upgrade is not possible, restrict network access to the /de2api/datasetData/previewSql endpoint (for example via a reverse-proxy/WAF rule or network ACL) so only trusted administrators can reach the SQL preview feature - trade-off: this disables SQL-based dataset preview for legitimate low-privilege analysts. Additionally, tighten the database accounts configured as DataEase datasources to least-privilege, read-scoped accounts limited to only the tables needed, which caps the blast radius of any query that does reach the JDBC layer, at the cost of some dataset flexibility.