Is there a patch available for CVE-2026-53729?

Yes, a patch is available for CVE-2026-53729. Update the affected software to the latest version immediately.

Dataease CVE-2026-53729

Q: What is the CVSS score of CVE-2026-53729?

CVE-2026-53729 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-42088 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-07 GitHub_M

Authentication Bypass Dataease

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Whitelisted download endpoint gives unauthenticated network read (PR:N, C:H); authenticated delete/retry of others' tasks adds limited integrity impact (I:L); low complexity, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 27, 2026 - 10:57 vuln.today

Patch available

Jul 07, 2026 - 22:01 EUVD

Analysis Generated

Jul 07, 2026 - 21:15 vuln.today

CVE Published

Jul 07, 2026 - 20:23 cve.org

HIGH 8.7

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, any authenticated user can download (/exportCenter/download/{id}), delete (/exportCenter/delete), retry (/exportCenter/retry/{id}), or generate download links (/exportCenter/generateDownloadUri/{id}) for export tasks belonging to other users by manipulating the task ID parameter, and the /exportCenter/download/{id} endpoint is whitelisted from authentication, allowing unauthenticated access to exported files. This issue is fixed in version 2.10.24.

AnalysisAI

Unauthorized access to exported data in DataEase before 2.10.24 allows any authenticated user to enumerate and manipulate other users’ export tasks via Insecure Direct Object Reference (IDOR), and the download endpoint /exportCenter/download/{id} lacks authentication, enabling unauthenticated data exfiltration. Exploitation requires only a valid account (for IDOR actions) or none at all (for download), and while no public exploit or active exploitation is confirmed, the vulnerability is rated High with a CVSS 4.0 base score of 8.7 and EPSS probability of 0.39%.