Vulnerability · Published Aug 31, 2026 · Assigned by VulnCheck

CVE-2026-82879DataEase before 2.10.26 Access Control Bypass via Share Tickets

Medium 6.3

In plain English

A medium-severity incorrect authorization in dataease from dataease. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 70.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another (ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo). The POST /de2api/share/validate endpoint issues a LinkToken after password verification without requiring a ticket, bypassing the 'ticket mandatory' policy. Additionally, the ticket create and delete endpoints (POST /de2api/ticket/saveTicket, POST /de2api/ticket/delTicket) lack share-ownership checks, allowing an authenticated user who knows another user's ticket to modify, rebind, or delete it (denial of service), and GET /de2api/share/queryRelationByUserId/{uid} allows authenticated users to enumerate other users' share mappings.

Affected products (as reported)

Vendor	Product	Versions
dataease	dataease	0 – before 2.10.26

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

GitHub Security Advisory (GHSA-9h54-39gh-5qfg) vendor-advisory
https://github.com/dataease/dataease/commit/fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db patch
DataEase v2.10.26 Release Notes release-notes
https://github.com/dataease/dataease product
VulnCheck Advisory: DataEase before 2.10.26 Access Control Bypass via Share Tickets third-party-advisory