by Kastro
Paper/Archive/CVE-2026-46684

CVE-2026-46684

dataease dataease — DataEase: Unauthorized Command Execution Vulnerability

EPSS 0.3%CVSS 9.5
critical.is priorityof 100
34
CVSS 9.5 (CNA)9.5 / 10 × 3028.5Not in CISA KEV+300.0EPSS percentile 24.9.249 × 205.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByToken(token) uses JWT.decode() without signature verification, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. This issue is fixed in version 2.10.23.

Affected

ProductAffectedFixed inSource
dataease< 2.10.23–CNA

Scores by source

GitHub_M (CNA)9.5CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/dataease/dataease/security/advisories/GHSA-gp6v-f7mm-458vrefgithub.com/dataease/dataease/commit/3efda9d29c0df4300d43bb7874638e03060c3e2drefgithub.com/dataease/dataease/releases/tag/v2.10.23