DataEase CVE-2026-90529

Exploitation requires: (1) a valid DataEase account with permissions to create or edit Symbolic Map chart visualizations - PR:L in the CVSS vector confirms authentication is required; (2) the Symbolic Map chart component must be enabled and in use within a dashboard; (3) a victim user must view or interact with the affected map visualization (passive user interaction, UI:P in CVSS 4.0). The attack is limited to users who have chart editing rights, ruling out fully unauthenticated exploitation. The scope of impact depends on the privilege level of the victim: a victim with admin rights enables session hijacking and privilege escalation, while a peer-level victim yields more limited impact. Non-default conditions that limit exploitation include: environments where chart editing is restricted to administrators only (reducing the attacker pool to already-privileged users), and deployments where the Symbolic Map component is not in active use.

The CVSS 4.0 score of 5.1 (Medium) reflects this accurately: AV:N/AC:L/PR:L/UI:P indicates network-reachable exploitation requiring low-privilege authentication and passive victim interaction. Real-world risk is moderate and well-represented by this score. The key limiting factors are the authentication prerequisite (attacker must have chart creation or editing rights) and the requirement that a victim views the affected map visualization. However, the impact can be amplified if the victim has administrative or elevated privileges, enabling session hijacking, credential theft, or privilege escalation via exfiltrated session tokens. EPSS data is not provided in the input. No KEV listing and no confirmed public exploit code exist, placing this in the 'no public exploit identified at time of analysis' category. The most significant risk driver is the lack of vendor response to the disclosure, meaning no patch timeline is known.

An attacker with a low-privilege DataEase account (e.g., a regular analyst role) edits a Symbolic Map chart and sets the tooltip.backgroundColor field to a crafted value containing a JavaScript payload. When an administrator or higher-privileged user opens the dashboard containing this chart and hovers over a map marker to trigger the tooltip, the injected script executes in their browser, exfiltrating their session cookie or authentication token to an attacker-controlled server. No public exploit code has been identified at time of analysis.