DataEase EUVD-2026-44776

Exploitation requires an authenticated DataEase account (CVSS PR:L) that can create or edit a datasource configuration and control the 'schema' field, then invoke the datasource connection status check (CalciteProvider#checkStatus) or table enumeration, which executes the schema value as SQL. The affected datasource must be one whose metadata query embeds the schema/owner - confirmed for DB2, SQL Server, PostgreSQL, and Oracle-style datasources. Limiting factors: the attacker cannot be fully anonymous (some privilege is needed to reach datasource management), no user interaction is required from a victim, and impact is bounded by the privileges of the database account DataEase uses to connect to that datasource.

The vendor-supplied CVSS 4.0 vector (8.7, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) indicates a network-reachable, low-complexity attack that requires some authentication (PR:L) and no user interaction, with high confidentiality and integrity impact and low availability impact - consistent with reading/modifying data on the connected database rather than crashing it. The key real-world limiter is PR:L: the attacker must already be an authenticated DataEase user with permission to create or edit a datasource configuration, which narrows the exposure to insiders or accounts obtained via other means rather than fully anonymous internet attackers. No EPSS score, no CISA KEV listing, and no public PoC were provided, so exploitation appears theoretical/latent at this time; the high CVSS is driven by impact and low complexity rather than by evidence of active exploitation. Net: a genuine and worth-patching injection for any DataEase instance where semi-trusted users can manage datasources, but not an emergency mass-exploitation scenario absent PoC or KEV signals.

A low-privileged but authenticated DataEase user with rights to add or edit a datasource sets a malicious 'schema' value containing SQL syntax, then triggers the connection status check or table listing. DataEase concatenates that schema into the metadata query and executes it against the connected DB2/SQL Server/PostgreSQL/Oracle database, letting the attacker exfiltrate or modify data via injected SQL. No public PoC is available, and the network vector with low complexity means the request is a single crafted datasource-check API call.