DataEase CVE-2026-82879

All attack paths require a valid authenticated DataEase session (PR:L); unauthenticated external attackers cannot exploit any of the four flaws. For cross-share ticket reuse (primary vector), the attacker must hold a legitimate ticket for at least one share they own and must know or be able to enumerate the target share's UUID; the target share must have ticket-required policy enabled. For the validate endpoint policy bypass, the attacker must supply the correct share password for the target share while the share has ticketRequire=true configured - the bypass grants a LinkToken without a ticket. For ticket deletion or rebinding (DoS vector), the attacker needs the victim's ticket string, obtainable via the insecure enumeration endpoint. For the enumeration endpoint, the attacker merely substitutes an arbitrary uid in the path parameter. Limiting factor across all four paths: a valid authenticated account on the DataEase instance is mandatory, excluding anonymous or external attackers and substantially narrowing the realistic threat population.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) yields a score of 5.3, which accurately reflects medium severity constrained by PR:L (requires a valid authenticated session) and uniformly low-level impacts. EPSS data is absent from the input; the authentication requirement and relatively narrow impact surface (sharing module only) reduce opportunistic or mass-exploitation risk considerably. The vulnerability is not listed in the CISA KEV catalog. Despite the moderate score, the four flaws compound meaningfully in multi-tenant or large-team deployments: an authenticated but low-trust insider can enumerate colleagues' shares, access protected share content, and cause availability disruption by deleting tickets - a realistic threat model for SaaS-style DataEase deployments. Defenders should treat this as a normal-cycle patch for isolated installations and an elevated-priority patch for environments with untrusted or semi-trusted authenticated users.

An authenticated DataEase user first calls GET /de2api/share/queryRelationByUserId/{victim_uid} with a target colleague's user ID to enumerate that user's share UUIDs. The attacker then submits their own legitimately issued ticket - obtained from a share they control - via POST /de2api/share/proxyInfo targeting the victim's password-protected share UUID, bypassing access controls and retrieving protected dashboard data. In a separate attack path, the attacker uses the enumerated ticket identifier to call POST /de2api/ticket/delTicket, invalidating the victim's share access for all end-users (denial of service). No public proof-of-concept code has been identified.