DataEase CVE-2026-50529

Exploitation requires the attacker to know a valid UUID of a password- or ticket-protected DataEase share and network access to the /de2api/share/proxyInfo endpoint; no valid password, ticket, account, or user interaction is needed, since the X-DE-LINK-TOKEN is issued before credential validation (PR:N/UI:N). The limiting factors are therefore: possession of a valid protected share UUID (not brute-forceable in practice due to UUID entropy, so typically obtained via leakage), reachability of the DataEase web interface, and a running version prior to 2.10.24. There is no dependence on a non-default feature - the share proxy behavior is inherent to affected versions.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N, base 8.7) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact and no integrity or availability impact - consistent with the description of unauthorized data disclosure via a leaked token. The one real precondition is knowledge of a valid protected share UUID, which is not reflected as an attack requirement in the vector (AT:N) and only modestly raises the practical bar, since UUIDs are often shared over chat/email, logged, or referenced in URLs. There is no CISA KEV listing and no evidence of a public POC, so exploitation is not confirmed in the wild; EPSS was not provided. Overall this is a genuine, easily-weaponizable confidentiality bug for internet-exposed DataEase instances, but scope is bounded to data behind shares whose UUIDs are known - priority is high for public deployments, moderate for internal-only ones.

An attacker learns a protected share UUID - for example from a forwarded link, browser history, proxy logs, or a shared chat message - and sends an unauthenticated request to /de2api/share/proxyInfo with a missing or wrong password. The endpoint returns a valid X-DE-LINK-TOKEN, which the attacker replays to the share APIs to read the protected dashboard's data without ever supplying the correct credential. No POC is currently public, but the network vector and low complexity make reliable exploitation straightforward once a UUID is known.