Which versions of DataEase are affected by EUVD-2026-42099?

DataEase business intelligence platform versions before 2.10.24 contain an unauthenticated authentication bypass enabling remote attackers to access password-protected dashboards and sensitive…. A patch is available.

How to fix or mitigate EUVD-2026-42099?

24 hours: Identify all DataEase deployments, verify versions, and assess exposure of internet-facing or untrusted-network-accessible instances. 7 days: Upgrade all affected instances to DataEase 2.10.24 or later after testing in non-production environments. 30 days: Audit access logs for unauthorized activity, confirm patch deployment across all systems, and evaluate network segmentation to limit exposure.

DataEase EUVD-2026-42099

Q: What is the CVSS score of EUVD-2026-42099?

EUVD-2026-42099 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-50529 HIGH

Incorrect Authorization (CWE-863)

2026-07-07 GitHub_M

Authentication Bypass Dataease

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated token issuance before credential check gives AV:N/AC:L/PR:N/UI:N; impact is confidential data disclosure only, so C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 07, 2026 - 22:01 EUVD

Analysis Generated

Jul 07, 2026 - 21:31 vuln.today

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns X-DE-LINK-TOKEN before validating the share password or ticket, allowing unauthenticated attackers who know a protected share UUID to obtain a valid link token for subsequent share-related API calls even with missing or invalid credentials. This issue is fixed in version 2.10.24.

AnalysisAI

Authentication bypass in DataEase open-source BI platform before 2.10.24 lets unauthenticated remote attackers who know a protected share UUID retrieve a valid X-DE-LINK-TOKEN from the /de2api/share/proxyInfo endpoint, because the token is issued before the share password or ticket is checked. With that token an attacker can call subsequent share APIs and read data behind password-protected dashboards without valid credentials. No public exploit identified at time of analysis; the flaw is fixed in 2.10.24.

Technical ContextAI

DataEase is a widely used open-source data visualization and analytics tool that exposes dashboards through 'share' links, some protected by a password or ticket. The vulnerability is a CWE-863 Incorrect Authorization flaw in the sharing subsystem: the /de2api/share/proxyInfo interface generates and returns the X-DE-LINK-TOKEN - the credential used to authorize downstream share-related API calls - before it validates the supplied password or ticket. This ordering error means credential validation is effectively cosmetic for token issuance; the token, not the password check, is what gates access to shared content, so an attacker who obtains the token bypasses the intended protection. The CPE cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:* confirms the DataEase application itself as the affected component across all versions prior to the fix.

RemediationAI

Vendor-released patch: upgrade to DataEase 2.10.24, which reorders the /de2api/share/proxyInfo logic to validate the share password or ticket before issuing the X-DE-LINK-TOKEN (fix commit c4e85a981e53c95b1ea73757db31e3025efdc410; release https://github.com/dataease/dataease/releases/tag/v2.10.24; advisory https://github.com/dataease/dataease/security/advisories/GHSA-7287-qqj9-phr6). If immediate patching is not possible, restrict network reachability of the DataEase instance - place it behind a VPN or IP allowlist and avoid direct internet exposure - and consider blocking or reverse-proxy filtering of the /de2api/share/proxyInfo path for untrusted sources; the trade-off is that this can break legitimate external share access. Rotating/regenerating existing share links after upgrade limits exposure of any UUIDs that may already have leaked, at the cost of invalidating previously distributed links.