Executive brief
DataEase is an open-source data visualization and analysis tool used to create dashboards and reports. A security flaw in the way the system handles shared links allows unauthorized individuals to bypass security checks and access private data. By exploiting a hardcoded security key, an attacker can impersonate the person who created a share link, gaining access to backend resources like datasets and charts even if the original link was revoked.
Technical details
The vulnerability exists in the `ShareSecretManage` class within the `core-backend` module. When a user creates a share link without a custom password, the system defaults to using a hardcoded HMAC-SHA256 signature key (`link-pwd-fit2cloud`) defined via a Spring `@Value` annotation. An attacker who obtains a valid resource ID and user ID can forge a `linkToken` JWT using this known key. Because the `TokenFilter` verification logic falls back to this same hardcoded default when no password is set for a share, the forged token will pass signature verification. This allows the attacker to bypass `TokenFilter` and access backend resources (dashboards, datasets, etc.) with the identity of the share creator, even if the original share has been revoked. This issue is an incomplete fix for a similar previous vulnerability (CVE-2024-52295).
Affected products
- DataEase DataEase < 2.10.24
Timeline
- 2026-06-18: advisory: GitHub advisory published by vendor
- 2026-07-07: disclosed: CVE published to NVD