Executive brief
DataEase is an open-source data visualization and analysis tool used to create business reports and dashboards. A security flaw in the export center allows unauthorized individuals to access, download, or delete data reports generated by other users. Because one specific download link was accidentally excluded from security checks, sensitive business information could be accessed by anyone on the network without a password.
Technical details
Multiple endpoints in the ExportCenterManage.java component, including /exportCenter/download/{id}, /exportCenter/delete, and /exportCenter/retry/{id}, fail to perform ownership validation. While the application generally uses AuthUtils to identify users, these specific methods retrieve tasks via exportTaskMapper.selectById(id) without verifying if the task's userId matches the requester's ID. Furthermore, WhitelistUtils.java explicitly whitelists the /exportCenter/download endpoint, allowing unauthenticated attackers to download any exported file if they can guess or enumerate the task ID. This combination of IDOR and authentication bypass enables unauthorized data exfiltration and deletion of export tasks. The issue is resolved in version 2.10.24.
Affected products
- DataEase DataEase < 2.10.24
Timeline
- 2026-06-10: patched: Fix committed to repository
- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE published to NVD