Which versions of DataEase are affected by CVE-2026-53730?

DataEase before version 2.10.24 contains a broken access control vulnerability allowing any authenticated user to execute arbitrary SQL queries against the core application database, enabling…. A patch is available.

How to fix or mitigate CVE-2026-53730?

Within 24 hours: Inventory all DataEase instances and document versions below 2.10.24. Within 7 days: Restrict network access to /de2api/datasetData/previewSql endpoint to administrative users only; implement WAF or firewall rules blocking this endpoint for non-admin access; reduce DataEase database account permissions to minimum-required operations. Within 30 days: Establish patch notification tracking with DataEase vendor; plan and test upgrade to patched version when released; conduct database access audit for unauthorized queries.

DataEase CVE-2026-53730

Q: What is the CVSS score of CVE-2026-53730?

CVE-2026-53730 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42091 HIGH

Missing Authorization (CWE-862)

2026-07-07 GitHub_M

Authentication Bypass Dataease

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-reachable endpoint exploitable by any authenticated user (PR:L) with no interaction; arbitrary SQL on the engine DB yields high confidentiality and integrity with limited availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 07, 2026 - 22:01 EUVD

Analysis Generated

Jul 07, 2026 - 21:20 vuln.today

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit permission validation annotation, allowing any authenticated user to specify datasourceId=-1, access the built-in engine database, execute arbitrary SQL statements, and read sensitive core data. This issue is fixed in version 2.10.24.

AnalysisAI

Broken access control in DataEase before 2.10.24 lets any authenticated low-privilege user reach the /de2api/datasetData/previewSql endpoint, which is missing its mandatory @DePermit authorization check, and pass datasourceId=-1 to hit the built-in engine database and execute arbitrary SQL. This CWE-862 missing-authorization flaw exposes sensitive core application data and carries a CVSS 4.0 base score of 8.7 (High). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

DataEase is an open-source business-intelligence and data-visualization platform (Java/Spring backend, cpe:2.3:a:dataease:dataease) that connects to external datasources and also ships an embedded 'built-in engine' database used to process and cache dataset data. Access to sensitive API endpoints is normally gated by a custom @DePermit annotation that enforces per-resource permission checks. The root cause (CWE-862, Missing Authorization) is that the datasetData/previewSql endpoint was deployed without this annotation, so the framework never evaluated whether the caller was entitled to the requested datasource. By supplying the sentinel value datasourceId=-1, a caller is routed to the internal engine database rather than a user-scoped external source, turning a SQL-preview convenience feature into an arbitrary-SQL execution primitive against DataEase's own core data store.

RemediationAI

Vendor-released patch: upgrade to DataEase 2.10.24, which restores the mandatory @DePermit permission validation on the datasetData/previewSql endpoint; this is the primary and recommended fix per advisory GHSA-2jmq-vffm-4qmj (https://github.com/dataease/dataease/security/advisories/GHSA-2jmq-vffm-4qmj) and commit 7b47af38b8fa017c9eecb00a4a49264663189e7b (https://github.com/dataease/dataease/commit/7b47af38b8fa017c9eecb00a4a49264663189e7b). If you cannot upgrade immediately, apply compensating controls: block or restrict access to the /de2api/datasetData/previewSql path at a reverse proxy or WAF (side effect: breaks legitimate SQL-preview functionality for dataset editors), disable self-registration and audit all low-privilege accounts to shrink the pool of potential attackers, and monitor application logs for requests to previewSql carrying datasourceId=-1 as an exploitation indicator. Because the fix is a small server-side annotation change, prioritize the version upgrade over long-lived workarounds.