What’s Vulnerable › Vulnerabilities

CVE-2026-50530: DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets

• Severity: high (CVSS 7.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-07 · updated 2026-07-08
• Weakness: CWE-639

Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the resourceId in the link token and fails to validate whether tableId and field IDs in the request body belong to the shared resource, allowing an attacker with a valid share link token to replace dataset identifiers and retrieve unauthorized data through POST /de2api/chartData/getData. This issue is fixed in version 2.10.24.

Affected products

• dataease: before 2.10.24

References

• https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410
• https://github.com/dataease/dataease/releases/tag/v2.10.24
• https://github.com/dataease/dataease/security/advisories/GHSA-qcf4-345v-6vg9
• https://github.com/dataease/dataease/security/advisories/GHSA-qcf4-345v-6vg9

Get alerted when CVE-2026-50530 or the next vulnerability affects your stack