What’s Vulnerable › Vulnerabilities

CVE-2026-82879: DataEase before 2.10.26 Access Control Bypass via Share Tickets

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-31 · updated 2026-09-08
• Weakness: CWE-863

Description

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another (ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo). The POST /de2api/share/validate endpoint issues a LinkToken after password verification without requiring a ticket, bypassing the 'ticket mandatory' policy. Additionally, the ticket create and delete endpoints (POST /de2api/ticket/saveTicket, POST /de2api/ticket/delTicket) lack share-ownership checks, allowing an authenticated user who knows another user's ticket to modify, rebind, or delete it (denial of service), and GET /de2api/share/queryRelationByUserId/{uid} allows authenticated users to enumerate other users' share mappings.

Affected products

• dataease: before 2.10.26 — fixed in 2.10.26

How to fix

Upgrade to a fixed version: dataease 2.10.26. Check the vendor advisory for mitigations.

References

• https://github.com/dataease/dataease
• https://github.com/dataease/dataease/commit/fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db
• https://github.com/dataease/dataease/releases/tag/v2.10.26
• https://github.com/dataease/dataease/security/advisories/GHSA-9h54-39gh-5qfg
• https://www.vulncheck.com/advisories/dataease-before-2.10.26-access-control-bypass-via-share-tickets

Get alerted when CVE-2026-82879 or the next vulnerability affects your stack