DataEase CVE-2026-50030

Requires an authenticated DataEase account (CVSS PR:L) with the ability to reach the SQL preview feature at /de2api/datasetData/previewSql and at least one configured datasource whose datasourceId the attacker can supply in PreviewSqlDTO. The attacker controls PreviewSqlDTO.sql (the injected/arbitrary SQL), datasourceId (which datasource to target), and isCross. Limiting factors: exploitation is not fully unauthenticated (low-privilege credentials are needed), impact is confined to data the configured datasource account can read (VI:N/VA:N - no write or destructive capability), and only versions prior to 2.10.23 are affected. Applies to default configurations of DataEase where the preview endpoint and datasources are available to logged-in users.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, base 7.1) describes a network-reachable, low-complexity attack that requires low-level privileges (PR:L) and yields high confidentiality impact but no integrity or availability impact - consistent with a read-only data exfiltration flaw rather than full RCE or data tampering. No EPSS score, KEV listing, or SSVC decision was provided, so exploitation probability and automatability cannot be quantified from the input; the flaw is not confirmed to be actively exploited. The realistic priority is moderate-to-high for internet-exposed or multi-tenant DataEase deployments because any authenticated (even low-privilege) user can pivot to reading arbitrary datasource tables, but the PR:L requirement and read-only scope keep it below a critical unauthenticated-RCE tier. Note the vendor description of 'arbitrary readable datasource tables' aligns with VI:N/VA:N - this is data disclosure, not modification, so treat it as an information-exposure priority.

A low-privilege authenticated DataEase user (or an attacker who has obtained any valid account) sends a crafted POST to /de2api/datasetData/previewSql with a PreviewSqlDTO whose sql field selects from a sensitive table and a valid datasourceId. DataEase decodes and executes the query via prepareStatement().executeQuery() and returns the rows in the preview response, exfiltrating data outside the user's authorized datasets. The network attack vector and low complexity make this trivial to script once credentials are held; no public POC was provided but the fix commit is public.