EasyReport CVE-2026-75978

Exploitation requires a valid low-privilege authenticated session on an EasyReport instance - the CVSS 4.0 vector metric PR:L explicitly confirms that some form of authentication is mandatory and unauthenticated exploitation is not possible. The attacker must be able to reach the DataSourceController.add HTTP endpoint over the network (AV:N, AC:L, AT:N - no additional attack preparation required beyond credentials). The vulnerability is specific to the QueryerFactory logic within DataSourceController.java; deployments where data source management endpoints are exposed to lower-trust authenticated user roles face the greatest risk. Exploitation is practically limited by the authentication prerequisite, the low CIA impact ceiling, and the absence of any scope change to other systems. No non-default application configuration is described as a prerequisite.

The CVSS 4.0 score of 2.1 reflects a genuinely low-severity issue: the attacker must hold at minimum low-privilege credentials (PR:L), and all CIA triad impacts are rated Low (VC:L/VI:L/VA:L) with no scope change affecting subsequent systems (SC:N/SI:N/SA:N). The E:P supplemental metric confirms a public POC exists, which modestly elevates realistic exploitation likelihood beyond unexploited findings. No CISA KEV listing is present and no EPSS data was included in the available intelligence, making the broader exploitation rate unknown. Even a mid-sized municipal IT team in tczew deploying EasyReport would face a narrow blast radius here - an attacker must already hold authenticated access, which substantially constrains the threat actor pool to insiders or post-compromise lateral movement scenarios. The lack of vendor response is a concern for long-term remediation but does not amplify the inherent severity of this permission boundary issue.

An attacker with a valid low-privilege EasyReport account sends a crafted HTTP POST to the DataSourceController.add endpoint, supplying a manipulated queryerClass argument that the QueryerFactory component fails to validate against a permitted type allowlist. Exploiting the permission gap, the attacker reads or modifies data source configurations beyond their authorized scope. A public proof-of-concept exists in GitHub issue #83, lowering the technical bar for exploitation by less-sophisticated actors.