Executive brief
DataEase is an open-source data visualization and analysis tool used to create dashboards and reports. A security flaw in the way the software handles shared links allows an attacker who has access to a legitimate shared chart to view other, unauthorized data. By modifying the request sent to the server, an attacker can bypass access controls to retrieve sensitive information from datasets they were never intended to see.
Technical details
An Insecure Direct Object Reference (IDOR) / Authorization Bypass (CWE-639) exists in the DataEase chart data interface. The vulnerability stems from insufficient server-side validation in the `DeLinkAop` interceptor and `ChartDataServer.getData()` method. While the application validates that the `sceneId` matches the `resourceId` in the provided `X-DE-LINK-TOKEN`, it fails to verify if the `tableId` and field IDs supplied in the POST request body actually belong to that authorized scene. A remote attacker with a valid share token can manipulate these identifiers to query and retrieve raw data from any dataset or table within the system. This issue is resolved in version 2.10.24.
Affected products
- DataEase DataEase < 2.10.24
Timeline
- 2026-06-18: patched: Fixed in version 2.10.24
- 2026-06-18: advisory: GitHub Security Advisory GHSA-qcf4-345v-6vg9 published
- 2026-07-07: disclosed: CVE-2026-50530 published to NVD