Is there a patch available for CVE-2026-82879?

Yes, a patch is available for CVE-2026-82879. Update the affected software to the latest version immediately.

DataEase CVE-2026-82879

Q: What is the CVSS score of CVE-2026-82879?

CVE-2026-82879 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-68465 MEDIUM

Incorrect Authorization (CWE-863)

2026-08-31 VulnCheck

GHSA-p7cf-5v9w-9rvj

Authentication Bypass Denial Of Service Dataease

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

All four flaws require network-accessible endpoints and a low-privilege authenticated session; impacts are bounded to share data disclosure, ticket integrity, and limited availability disruption.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 31, 2026 - 11:17 vuln.today

Analysis Generated

Aug 31, 2026 - 11:17 vuln.today

DescriptionCVE.org

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another (ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo). The POST /de2api/share/validate endpoint issues a LinkToken after password verification without requiring a ticket, bypassing the 'ticket mandatory' policy. Additionally, the ticket create and delete endpoints (POST /de2api/ticket/saveTicket, POST /de2api/ticket/delTicket) lack share-ownership checks, allowing an authenticated user who knows another user's ticket to modify, rebind, or delete it (denial of service), and GET /de2api/share/queryRelationByUserId/{uid} allows authenticated users to enumerate other users' share mappings.

AnalysisAI

Four discrete access control defects in DataEase's sharing link module (versions before 2.10.26) allow any authenticated platform user to cross-access password-protected shares, enumerate other users' share mappings, and disrupt share availability by manipulating tickets they do not own. The flaws span ticket validation (cross-share reuse via ShareTicketManage.validateTicket), password-verification bypass of the mandatory-ticket policy (POST /de2api/share/validate), unauthorized ticket mutation/deletion, and insecure user-ID handling in the share enumeration endpoint. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	All attack paths require a valid authenticated DataEase session (PR:L); unauthenticated external attackers cannot exploit any of the four flaws. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) yields a score of 5.3, which accurately reflects medium severity constrained by PR:L (requires a valid authenticated session) and uniformly low-level impacts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade DataEase to version 2.10.26 or later; this release incorporates all four authorization fixes via commit fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db and is available at https://github.com/dataease/dataease/releases/tag/v2.10.26. … Detailed patch versions, workarounds, and compensating controls in full report.