DataEase EUVD-2026-42091

Exploitation requires a valid authenticated DataEase account of any privilege level (CVSS PR:L) with network access to the application; no administrative role, no user interaction, and no non-default configuration are needed because the missing @DePermit annotation affects the default code path. The specific trigger is a request to the /de2api/datasetData/previewSql endpoint with the parameter datasourceId=-1, which redirects the query to the internal built-in engine database. The main limiting factor is the authentication requirement: an attacker must first obtain or create an account, so deployments that restrict registration and issue accounts only to trusted users face materially lower risk, while instances with open self-registration or widely shared low-tier logins are directly exposed.

The signals are broadly consistent and point to a genuine priority for any multi-user DataEase deployment. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L, score 8.7 High) indicates a network-reachable, low-complexity attack needing only a single low-privilege authenticated account and no user interaction, with high confidentiality and integrity impact. PR:L is the key limiter: this is not unauthenticated, so exposure scales with how easily an attacker can obtain any valid account (self-registration, shared viewer logins, or a compromised low-tier credential). There is no EPSS score, KEV entry, or POC in the provided data, so real-world exploitation is currently unproven - treat likelihood as moderate/inferred rather than confirmed. One imbalance to note explicitly: the vendor rates confidentiality and integrity High but availability Low, yet 'arbitrary SQL statements' against the engine database could in principle include destructive DDL/DML, so the VA:L rating may understate availability risk - verify against the vendor advisory. Overall, prioritize patching wherever untrusted or numerous users hold accounts.

An attacker who registers or is granted any low-privilege DataEase account sends a crafted authenticated request to /de2api/datasetData/previewSql with datasourceId set to -1 and an arbitrary SQL statement. Because the endpoint no longer enforces @DePermit, the query executes directly against the built-in engine database, letting the attacker read core application data such as user records, credentials, or cached dataset contents. No public exploit is identified at time of analysis, but the low complexity makes weaponization straightforward for anyone with a foothold account.