CVE-2026-50530 | THREATINT

Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the resourceId in the link token and fails to validate whether tableId and field IDs in the request body belong to the shared resource, allowing an attacker with a valid share link token to replace dataset identifiers and retrieve unauthorized data through POST /de2api/chartData/getData. This issue is fixed in version 2.10.24.

PUBLISHED Reserved 2026-06-04 | Published 2026-07-07 | Updated 2026-07-08 | Assigner GitHub_M

HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-639: Authorization Bypass Through User-Controlled Key

Product status

< 2.10.24

affected

References

github.com/...taease/security/advisories/GHSA-qcf4-345v-6vg9 exploit

github.com/...taease/security/advisories/GHSA-qcf4-345v-6vg9

github.com/...ommit/c4e85a981e53c95b1ea73757db31e3025efdc410

github.com/dataease/dataease/releases/tag/v2.10.24

cve.org (CVE-2026-50530)

nvd.nist.gov (CVE-2026-50530)

Download JSON