Which versions of DataEase are affected by CVE-2026-55635?

DataEase versions before 2.10.24 contain a SQL injection vulnerability allowing authenticated users to execute arbitrary database queries against configured datasources, creating significant insider…. A patch is available.

How to fix or mitigate CVE-2026-55635?

Within 24 hours: Inventory all DataEase deployments and document installed versions. Within 7 days: Restrict DataEase user access to documented business roles only, enable comprehensive logging of all filter and aggregation operations, and configure database connection limits at the datasource level. Within 30 days: Apply patch to DataEase 2.10.24 or later upon vendor release; simultaneously audit user activity logs since deployment for unauthorized query execution patterns.

DataEase CVE-2026-55635

Q: What is the CVSS score of CVE-2026-55635?

CVE-2026-55635 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42096 HIGH

SQL Injection (CWE-89)

2026-07-07 GitHub_M

SQLi Dataease

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-reachable SQLi needing an authenticated chart-authoring account (PR:L), no user interaction, high confidentiality/integrity impact on back-end data with limited availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 07, 2026 - 22:01 EUVD

Analysis Generated

Jul 07, 2026 - 21:29 vuln.today

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, chart quota and Y-axis filters embed attacker-controlled filter values directly into generated SQL in Quota2SQLObj.getYWheres() without applying the SQL literal validation and escaping used by other filter paths, allowing an authenticated user who can create or modify chart definitions or submit chart data requests containing quota filters to inject SQL into queries executed against configured datasources. This issue is fixed in version 2.10.24.

AnalysisAI

SQL injection in DataEase before 2.10.24 lets an authenticated user inject arbitrary SQL into queries run against configured datasources by supplying malicious quota (chart aggregation) or Y-axis filter values. The flaw sits in Quota2SQLObj.getYWheres(), which embeds attacker-controlled filter values directly into generated SQL while skipping the literal validation and escaping that other filter paths enforce. No public exploit identified at time of analysis, but the fixing commit and GitHub Security Advisory publicly disclose the exact vulnerable code path.

Technical ContextAI

DataEase is an open-source (Java/Spring-based) business intelligence and data visualization platform that builds charts by translating user-defined filters and aggregations into SQL executed against back-end datasources (MySQL, PostgreSQL, and other JDBC targets). The root cause is CWE-89 (SQL Injection): the getYWheres() method in the Quota2SQLObj class concatenates raw quota/Y-axis filter values into the WHERE clause of generated SQL without routing them through the shared SQL literal validation and escaping routine that DataEase applies to its other filter builders. This inconsistency - one filter path hardened, another not - is a classic incomplete-mitigation pattern. The single affected CPE is cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*, i.e. all DataEase versions prior to 2.10.24.

RemediationAI

Vendor-released patch: 2.10.24 - upgrade all DataEase instances to 2.10.24 or later, which applies the missing SQL literal validation/escaping to the quota and Y-axis filter path (see advisory GHSA-p758-rx6v-hc8g and commit 4463e21cb73d3d4bb8af89a0cb71ee403e4b808a). If an immediate upgrade is not possible, reduce exposure by tightening who can create or modify chart definitions and submit chart-data requests carrying quota filters (restrict to trusted operators only), and by giving the datasource connection accounts the least privilege necessary (read-only, scoped schemas) so an injection cannot modify data or pivot - noting the trade-off that read-only accounts still allow data exfiltration and that restricting chart authoring limits legitimate self-service analytics. Placing the DataEase UI behind network access controls / VPN further limits the pool of potential authenticated attackers. These are compensating controls only; upgrading to 2.10.24 is the definitive fix.