DataEase up to 2.10.23 Share Mode Chart Data Interface getData improper authorization

Summaryinfo

A vulnerability was found in DataEase up to 2.10.23. It has been classified as problematic. Impacted is an unknown function of the file /de2api/chartData/getData of the component Share Mode Chart Data Interface. Performing a manipulation results in improper authorization. This vulnerability is cataloged as CVE-2026-50530. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in DataEase up to 2.10.23. This affects an unknown code block of the file /de2api/chartData/getData of the component Share Mode Chart Data Interface. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality. The summary by CVE is:

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the resourceId in the link token and fails to validate whether tableId and field IDs in the request body belong to the shared resource, allowing an attacker with a valid share link token to replace dataset identifiers and retrieve unauthorized data through POST /de2api/chartData/getData. This issue is fixed in version 2.10.24.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-50530 since 06/04/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

Upgrading to version 2.10.24 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-42100). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• DataEase

Version

• 2.10.0
• 2.10.1
• 2.10.2
• 2.10.3
• 2.10.4
• 2.10.5
• 2.10.6
• 2.10.7
• 2.10.8
• 2.10.9
• 2.10.10
• 2.10.11
• 2.10.12
• 2.10.13
• 2.10.14
• 2.10.15
• 2.10.16
• 2.10.17
• 2.10.18
• 2.10.19
• 2.10.20
• 2.10.21
• 2.10.22
• 2.10.23

Website

• Product: https://github.com/dataease/dataease/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion