CVE-2026-46684: DataEase: Unauthorized Command Execution Vulnerability

Severity: critical (CVSS 9.5 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-15 · updated 2026-07-17
Weakness: CWE-347

Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByToken(token) uses JWT.decode() without signature verification, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. This issue is fixed in version 2.10.23.

Affected products

dataease: before 2.10.23

References

https://github.com/dataease/dataease/commit/3efda9d29c0df4300d43bb7874638e03060c3e2d
https://github.com/dataease/dataease/releases/tag/v2.10.23
https://github.com/dataease/dataease/security/advisories/GHSA-gp6v-f7mm-458v

Get alerted when CVE-2026-46684 or the next vulnerability affects your stack