Vulnerability · Published Jul 7, 2026 · Assigned by GitHub_M

CVE-2026-50530DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets

High 7.1

In plain English

A high-severity authorization bypass via user-controlled key in dataease from dataease. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.4%top 64.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the resourceId in the link token and fails to validate whether tableId and field IDs in the request body belong to the shared resource, allowing an attacker with a valid share link token to replace dataset identifiers and retrieve unauthorized data through POST /de2api/chartData/getData. This issue is fixed in version 2.10.24.

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	< 2.10.24

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/dataease/dataease/security/advisories/GHSA-qcf4-345v-6vg9 x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410 x_refsource_MISC
https://github.com/dataease/dataease/releases/tag/v2.10.24 x_refsource_MISC