DataEase CVE-2026-82878

Exploitation requires a valid authenticated DataEase user session (PR:L per CVSS 4.0 vector); unauthenticated external attackers cannot exploit this directly. No special feature configuration or non-default deployment mode is required - the missing authorization checks affect the default DataEase installation across all versions before 2.10.26. The attacker must be able to reach the DataEase REST API over the network. Successful exploitation of the integrity and availability impacts (overwriting or deleting map geometry, modifying linkages) requires knowledge of target resource identifiers, which may necessitate enumeration of sequential or guessable integer IDs. Confidentiality impact (chart metadata retrieval) is similarly dependent on identifier knowledge. The map geometry deletion and write paths are further constrained post-patch to system administrators only, indicating these were previously reachable by any authenticated user.

The CVSS 4.0 score of 5.3 with vector AV:N/AC:L/AT:N/PR:L reflects moderate real-world risk. The attack is low-complexity and requires no special attack conditions, but authentication (PR:L) is mandatory, constraining the exposure to existing platform users. The impact across confidentiality, integrity, and availability is uniformly low - chart metadata exfiltration, linkage modification, and map geometry corruption are meaningful in multi-tenant deployments but are not system-level compromises. No EPSS data is available to quantify exploitation probability, and the absence of KEV listing and public POC suggests no current threat actor exploitation. The integrity and availability dimensions may be underappreciated in raw scores: the ability to overwrite or delete shared geographic datasets and dashboard linkages could disrupt operational analytics for all users of a shared instance, warranting priority patching in any deployment where DataEase serves multiple teams or external stakeholders. Overall this is a genuine priority for shared-instance operators but lower urgency for single-tenant, internally-isolated deployments.

An authenticated low-privilege DataEase user enumerates chart and dashboard resource identifiers by incrementing integer IDs in API requests to the chart detail or linkage endpoints, retrieving configuration metadata and linkage definitions belonging to other users. The attacker then submits crafted requests to the map geometry endpoint with a victim's resource identifier to overwrite or delete geographic layer data, corrupting shared operational dashboards without triggering any authorization error in pre-patch versions.