CVE-2026-75978 in EasyReport
Summary
by MITRE • 08/19/2026
A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. The affected element is the function DataSourceController.add of the file DataSourceController.java of the component QueryerFactory. Such manipulation of the argument queryerClass leads to permission issues. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in xianrendzw EasyReport, specifically within versions up to 2.0.17.0522_Beta, represents a critical security flaw rooted in improper access control mechanisms during the dynamic instantiation of data source components. The core technical issue resides in the DataSourceController.add method located within the DataSourceController.java file and associated with the QueryerFactory component. This function is responsible for accepting user-supplied input to determine which class should be instantiated as the query engine or data source handler. When an attacker provides a manipulated value for the queryerClass argument, they can bypass intended authorization checks that are supposed to restrict such operations to privileged administrators only. Instead of validating whether the requesting user has the necessary permissions to define new data sources or load specific classes, the application proceeds with the instantiation process based solely on the provided class name. This lack of robust server-side access control allows unauthenticated or low-privilege users to execute actions that should be restricted, effectively granting them elevated privileges within the context of the web application.
From a technical perspective, this flaw is characteristic of an insecure direct object reference combined with insufficient authorization checks on critical administrative functions. By manipulating the queryerClass parameter, an attacker can potentially load arbitrary classes into the Java Virtual Machine environment running the EasyReport instance. If the classpath includes libraries that allow for remote code execution or if the instantiated class interacts dangerously with system resources, this could lead to severe consequences beyond simple privilege escalation. The vulnerability aligns closely with CWE-269, which describes Improper Privilege Management, as it involves a user gaining access to functionality reserved for higher-level roles without proper verification of their authority. Furthermore, because the manipulation occurs via HTTP requests sent over a network interface, this falls under the category of remote attacks where no prior local access is required, significantly increasing its severity and exploitability in internet-facing deployments.
The operational impact of this vulnerability is substantial due to its potential for remote exploitation. Since the attack can be launched remotely by any actor with network connectivity to the vulnerable service, it poses a direct threat to data integrity and confidentiality within the reporting infrastructure. An attacker could potentially extract sensitive business intelligence reports, modify report configurations to alter output formats or destinations, or in worst-case scenarios, achieve arbitrary code execution if specific dangerous classes are available on the classpath. The fact that public exploits have been disclosed amplifies this risk, as automated scanning tools and malicious actors can easily leverage these known techniques to compromise vulnerable instances without needing custom development skills. This widespread availability of exploit material means that systems running affected versions are likely under active surveillance by threat actors seeking quick wins against poorly secured enterprise applications.
Industry frameworks such as MITRE ATT&CK classify this type of vulnerability within the Initial Access and Privilege Escalation tactics, specifically relating to exploitation for credential access or privilege escalation through application layer vulnerabilities. The lack of response from the project maintainers despite early notification via issue reports exacerbates the situation by leaving users without official patches or workarounds in a timely manner. Consequently, organizations relying on EasyReport must treat this as an active threat requiring immediate mitigation strategies rather than waiting for upstream fixes. Security teams should prioritize identifying all instances of the software within their environment and applying compensating controls to limit exposure until a patched version is available.
To mitigate these risks, administrators should immediately restrict network access to the affected application components using firewall rules or reverse proxy configurations that enforce strict authentication before any requests reach the DataSourceController endpoint. Implementing Web Application Firewall (WAF) signatures can help detect and block attempts to manipulate class names in request parameters by filtering out suspicious patterns associated with Java deserialization or reflection-based attacks. Additionally, enabling detailed logging for all administrative actions related to data source configuration allows security operations centers to monitor for anomalous activity indicative of exploitation attempts. It is also advisable to review the application's deployment architecture to ensure that the EasyReport service runs under a least-privilege user account with minimal system-level permissions, thereby reducing the potential impact if an attacker successfully exploits this flaw. Regular audits of third-party library dependencies and keeping software components updated are essential practices to prevent similar vulnerabilities from being introduced or left unpatched in production environments.