Executive brief
DataEase is an open-source business intelligence and data visualization tool. Multiple access control defects in its sharing mechanism allow authenticated users to reuse or forge share access tokens, enumerate other users' shared content, and modify or delete shares belonging to other users, potentially disrupting access to shared dashboards and reports.
Technical details
The vulnerability consists of multiple authorization flaws in the sharing module: (1) Share tickets are not validated against the target share UUID, permitting ticket reuse across different shares; (2) the password-validation endpoint (POST /de2api/share/validate) issues LinkTokens without requiring a ticket, circumventing ticket-mandatory policies; (3) ticket creation and deletion endpoints lack ownership checks, allowing authenticated attackers to modify or delete tickets they do not own; (4) the share-enumeration endpoint (GET /de2api/share/queryRelationByUserId/{uid}) lacks authorization checks, exposing other users' share mappings. Network access and valid credentials are required; patches are available in version 2.10.26 and later.
Affected products
- DataEase DataEase before 2.10.26
Timeline
- 2026-08-31: disclosed