CVE-2026-50530 Details
Description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the resourceId in the link token and fails to validate whether tableId and field IDs in the request body belong to the shared resource, allowing an attacker with a valid share link token to replace dataset identifiers and retrieve unauthorized data through POST /de2api/chartData/getData. This issue is fixed in version 2.10.24.
A vulnerability in DataEase versions prior to 2.10.24 allows unauthorized access to data through the share mode chart data interface. The issue arises because the interface only validates that the sceneId matches the resourceId in the link token. It fails to ensure that the tableId and field IDs in the request body belong to the shared resource. As a result, an attacker with a valid share link token can manipulate dataset identifiers to retrieve unauthorized data via the POST /de2api/chartData/getData endpoint.
Users are advised to upgrade to DataEase version 2.10.24, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 7, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dataease/dataease/security/advisories/GHSA-qcf4-345v-6vg9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410 | [email protected] | Source CodeVendor |
| https://github.com/dataease/dataease/releases/tag/v2.10.24 | [email protected] | Release NotesVendor |
| https://github.com/dataease/dataease/security/advisories/GHSA-qcf4-345v-6vg9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DataEase | < 2.10.24 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |