DataEase EUVD-2026-23290

Requires an authenticated account with permission to create or update a datasource (CVSS PR:L). The concrete trigger is submitting a datasource update to /de2api/datasource/update that adds a new table definition, supplying a malicious deTableName value that breaks out of identifier quoting in the CREATE TABLE template handled by DatasourceSyncManage.createEngineTable. Limiting factors: valid credentials and datasource-management privileges are needed, exploitation is per-target and not automatable (SSVC Automatable:no), and only versions ≤ 2.10.20 are affected. No user interaction beyond the attacker's own request is required (UI:N).

Signals are mixed and lean toward moderate real-world priority. The CVSS 4.0 base of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H) reflects a network-reachable, low-complexity flaw with high confidentiality and integrity impact, and SSVC rates Technical Impact as 'total' - consistent with full read/exfiltration of the datastore. However, PR:L means valid authentication is required, SSVC marks Automatable:no (per-target exploitation, no spray-and-pray), and EPSS is only 0.03% (8th percentile), indicating no observed mass exploitation. Exploitation status is 'poc' in SSVC and it is NOT in CISA KEV, so this is a real, patchable weakness with demonstrated exploitability but no evidence of active in-the-wild use. Net: prioritize patching on internet-exposed or multi-tenant DataEase instances, but this is not a wormable, unauthenticated emergency.

An authenticated DataEase user (or an attacker who has obtained low-privilege credentials) sends a datasource update to /de2api/datasource/update containing a new table whose deTableName is crafted to break out of the CREATE TABLE identifier quoting and append malicious SQL. The resulting database error messages leak query results, letting the attacker enumerate schemas and exfiltrate data. A proof-of-concept is indicated (SSVC exploitation: poc), and the low attack complexity (AC:L) makes reliable exploitation straightforward once access is obtained.