Dataease CVE-2026-8724

Requires authenticated access with high-privilege credentials (CVSS PR:H) - specifically an administrator or power-user account with permissions to access the Data Dashboard component and create/modify SQL-based filters. The vulnerability is in the SqlparserUtils.transFilter function used when processing user-defined filters in dashboard visualizations, so exploitation requires the attacker to have both authentication AND the dashboard functionality enabled. No special non-default configuration is indicated beyond having a Dataease instance deployed and the Data Dashboard feature in use. Exploitation is limited by authentication strength (MFA presence, password policies, account monitoring) and database permissions granted to the Dataease application user. Network accessibility (AV:N) means remote exploitation is possible against any internet-exposed Dataease instance, but PR:H ensures only credential holders or those who compromise admin accounts can exploit this flaw.

Real-world risk is moderate and highly context-dependent. The CVSS vector (AV:N/AC:L/PR:H/UI:N) indicates network-accessible exploitation with low complexity but requires high-privilege credentials, significantly limiting the attack surface compared to unauthenticated vulnerabilities. The presence of public exploit code (GitHub repository explicitly linked in references) removes technical barriers for attackers who already possess admin credentials through phishing, credential stuffing, or insider threats. EPSS data is not provided, preventing probability-of-exploitation quantification. No CISA KEV listing indicates this is not yet observed in widespread active exploitation campaigns. The CVSS scope is unchanged (S:U), meaning exploitation cannot pivot beyond the vulnerable component's security context. Confidentiality, integrity, and availability impacts are all rated Low (C:L/I:L/A:L), suggesting limited database compromise rather than full system control. Priority should focus on organizations where: (1) Dataease admin accounts have weak credential hygiene, (2) dashboards process sensitive data, or (3) the database user has elevated privileges beyond what Dataease requires. For environments with strong admin account controls and principle-of-least-privilege database configurations, this rates lower than the CVSS score suggests.

An attacker with stolen or compromised Dataease administrator credentials logs into the web interface and navigates to the Data Dashboard component. They craft a malicious SQL filter input targeting the SqlparserUtils.transFilter function, injecting SQL syntax such as 'variable'; DROP TABLE sensitive_data; -- to execute arbitrary commands. The vulnerable code concatenates this input into a SQL query without sanitization, allowing the attacker to exfiltrate customer data via UNION-based injection, modify financial records to manipulate reports, or disrupt services by dropping tables. Public exploit code from the GitHub repository (https://github.com/xpp3901/CVE_APPLY/tree/main/V-D001_DataEase_SqlVariable_Injection) provides ready-to-use payloads, making this scenario executable by moderately skilled attackers who have obtained admin credentials through phishing or password reuse.