Which versions of DataEase are affected by CVE-2026-50530?

DataEase before version 2.10.24 contains an authorization bypass allowing share-link recipients to extract datasets beyond their intended scope, exposing sensitive organizational data to authorized…. A patch is available.

How to fix or mitigate CVE-2026-50530?

Within 24 hours: Audit all active DataEase share-link tokens and immediately revoke any shared with external or untrusted recipients; document current internal share-link users and their permitted datasets. Within 7 days: Implement network-layer access controls restricting POST requests to /de2api/chartData/getData to internal networks only; enable detailed logging to detect suspicious variations in tableId parameters. Within 30 days: Upgrade DataEase to version 2.10.24 or later when released; until patch availability is confirmed with vendor, evaluate migration to alternative analytics platforms if data sensitivity mandates immediate risk elimination.

DataEase CVE-2026-50530

Q: What is the CVSS score of CVE-2026-50530?

CVE-2026-50530 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42100 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-07 GitHub_M

Authentication Bypass Dataease

7.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network endpoint reachable with low complexity; PR:L because a valid share-link token is required; confidentiality-only data exposure with no integrity or availability impact and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 07, 2026 - 22:01 EUVD

Analysis Generated

Jul 07, 2026 - 21:32 vuln.today

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the resourceId in the link token and fails to validate whether tableId and field IDs in the request body belong to the shared resource, allowing an attacker with a valid share link token to replace dataset identifiers and retrieve unauthorized data through POST /de2api/chartData/getData. This issue is fixed in version 2.10.24.

AnalysisAI

Insecure Direct Object Reference in DataEase before 2.10.24 lets a holder of any valid share-link token retrieve arbitrary datasets by tampering with the request body. The share-mode chart endpoint POST /de2api/chartData/getData validates only that sceneId matches the resourceId bound to the link token, but never checks that the supplied tableId and field IDs belong to the shared resource, so an attacker can swap in identifiers for datasets they were never granted. No public exploit is identified at time of analysis, but the flaw is trivially exploitable by anyone already given a legitimate share link.

Technical ContextAI

DataEase is an open-source business-intelligence and data-visualization platform (Chinese vendor, GitHub project dataease/dataease) that supports publishing dashboards and charts via shareable links protected by a scoped link token. The vulnerability is a classic CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the server-side authorization check for the share API is incomplete. It confirms the outer scene (sceneId == resourceId encoded in the token) but performs no ownership or membership validation on the inner data-source references - the tableId and field IDs carried in the JSON body of the getData call. Because those identifiers are attacker-controllable and directly select which dataset/columns are queried, the missing object-level authorization allows horizontal privilege escalation across all datasets the DataEase instance can reach. Per CPE cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:* all versions prior to the 2.10.24 release are affected.

RemediationAI

Vendor-released patch: upgrade DataEase to version 2.10.24 or later, which adds validation that the tableId and field IDs in the getData request belong to the shared resource (fix commit c4e85a981e53c95b1ea73757db31e3025efdc410, release https://github.com/dataease/dataease/releases/tag/v2.10.24, advisory https://github.com/dataease/dataease/security/advisories/GHSA-qcf4-345v-6vg9). If immediate upgrade is not possible, reduce exposure by disabling or revoking existing public share links and restricting the sharing feature to trusted internal users, and place the DataEase instance behind network/VPN access controls or an authenticating reverse proxy so the /de2api/chartData/getData endpoint is not reachable by untrusted parties - noting the trade-off that these controls break legitimate external sharing workflows. Rotating share-link tokens after upgrade further limits any tokens that may already be circulating.