CVE-2026-46684: DataEase: Unauthorized Access to Sensitive Data

Summary

DataEase's license validation can be bypassed, allowing attackers to create fake tokens and access sensitive data. This issue has been fixed in version 2.10.23. It's essential to update to the latest version to prevent unauthorized access.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions
dataease	dataease	< 2.10.23

Original title

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(),...

Original description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByToken(token) uses JWT.decode() without signature verification, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. This issue is fixed in version 2.10.23.

Vulnerability type

CWE-347 Improper Verification of Cryptographic Signature

https://github.com/dataease/dataease/security/advisories/GHSA-gp6v-f7mm-458v x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/3efda9d29c0df4300d43bb7874638e03060c... x_refsource_MISC
https://github.com/dataease/dataease/releases/tag/v2.10.23 x_refsource_MISC