Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-46684DataEase: Unauthorized Command Execution Vulnerability

Critical 9.5

In plain English

A critical-severity security flaw in dataease from dataease. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 4.0)9.5Critical

Exploit odds (30 days)0.3%top 75.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByToken(token) uses JWT.decode() without signature verification, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. This issue is fixed in version 2.10.23.

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	< 2.10.23

Weakness: CWE-347 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://github.com/dataease/dataease/security/advisories/GHSA-gp6v-f7mm-458v x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/3efda9d29c0df4300d43bb7874638e03060c3e2d x_refsource_MISC
https://github.com/dataease/dataease/releases/tag/v2.10.23 x_refsource_MISC