SB2026073056 - Multiple vulnerabilities in DataEase

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026073056

SB2026073056 - Multiple vulnerabilities in DataEase

Published: July 30, 2026

Security Bulletin ID SB2026073056
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 13
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 38% Low 62%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 13 vulnerabilities.


1) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to SQL injection in the H2 JDBC URL handling used by the datasource schema test endpoint when processing a user-supplied JDBC URL. A remote user can send a specially crafted request containing a crafted JDBC URL to execute arbitrary code.

The issue bypasses a blacklist that blocks the H2 keywords INIT and RUNSCRIPT by abusing semicolon and backslash parsing behavior during connection establishment.


2) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to bypass share access restrictions.

The vulnerability exists due to improper access control in ShareTicketManage.validateTicket and the /de2api/share/proxyInfo endpoint when validating share tickets against share UUIDs. A remote user can submit a valid ticket issued for one share against a different share to bypass share access restrictions.

Exploitation requires a valid authenticated session and successful password verification for the target share.


3) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to bypass mandatory ticket requirements for shared resources.

The vulnerability exists due to improper access control in the /de2api/share/validate endpoint when verifying the share UUID and password without requiring a ticket. A remote user can submit a share UUID and password without a ticket to bypass mandatory ticket requirements for shared resources.

This issue affects shares configured with ticketRequire=true.


4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to modify or delete other users' share tickets.

The vulnerability exists due to improper access control in the /de2api/ticket/saveTicket and /de2api/ticket/delTicket endpoints when handling ticket update and deletion requests without ownership validation. A remote user can submit a known ticket value to modify ticket bindings and settings or delete the ticket to modify or delete other users' share tickets.

The issue may also allow adjustment of ticket expiry time and configuration parameters.


5) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose other users' share mappings.

The vulnerability exists due to improper access control in the /de2api/share/queryRelationByUserId/{uid} endpoint when querying share relationships by a supplied user ID without restricting access to the requester's own data or requiring administrator privileges. A remote user can query another user's uid to disclose other users' share mappings.

The exposed data includes mappings between resourceId and share UUID.


6) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to modify or delete global map resources.

The vulnerability exists due to improper access control in the geographic information interfaces when handling crafted requests to geographic resource endpoints. A remote user can send requests to persist, delete, or modify map resources to modify or delete global map resources.

The issue affects global geographic information and GeoJSON mappings used by other users and dashboards.


7) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to modify or delete linkage configurations belonging to other users' dashboards.

The vulnerability exists due to improper access control in the linkage write interfaces when processing requests that supply dashboard and view identifiers. A remote user can send a specially crafted request using another user's dashboard identifiers to modify or delete linkage configurations belonging to other users' dashboards.

Exploitation requires knowledge of another user's dashboard ID.


8) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose chart metadata and partial calculation results.

The vulnerability exists due to improper access control in the chart ID-based access endpoints when processing requests that reference chart, dataset, or field identifiers. A remote user can send a specially crafted request with a known chart ID to disclose chart metadata and partial calculation results.

In multi-tenant or multi-project deployments, this can result in cross-user or cross-project information leakage.


9) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary SQL commands.

The vulnerability exists due to SQL injection in DatasetTableFieldDTO.dateFormat and related SQL template processing when rendering a chart that uses a field with a crafted custom date format. A remote user can store a specially crafted dateFormat value and trigger chart rendering to execute arbitrary SQL commands.

On cross-datasource datasets, the generated SQL bypasses Calcite parsing entirely, making exploitation deterministic. On single-datasource datasets, the payload must remain a valid string literal after Calcite reserialization.


10) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary SQL commands on the backend.

The vulnerability exists due to SQL injection in io.dataease.engine.utils.Utils#transGroupFieldToSql when rendering a chart built on a dataset group-field with crafted binning bounds. A remote user can store a specially crafted SQL payload in min, max, startTime, or endTime values to execute arbitrary SQL commands on the backend.

The issue is stored and is triggered when a chart using the poisoned field is rendered, including by viewers of a shared chart.


11) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to execute arbitrary SQL.

The vulnerability exists due to SQL injection in datasource metadata identifier handling in CalciteProvider when processing datasource metadata requests with user-controlled schema names, usernames, or table or database names. A remote user can send a specially crafted datasource configuration request to execute arbitrary SQL.

The injected SQL is executed against the connected backend database using the application's stored datasource credentials during metadata checks.


12) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary JavaScript in a victim's session.

The vulnerability exists due to cross-site scripting in the axis label tooltip in core/core-frontend/src/views/chart/components/js/panel/common/common_antv.ts when rendering a truncated bar-horizontal chart axis label tooltip. A remote user can store a malicious dimension value in chart data and trigger script execution when another user hovers the truncated axis label to execute arbitrary JavaScript in a victim's session.

User interaction is required to hover a truncated axis label, and exploitation requires the ability to edit dataset fields and dashboard chart configuration.


13) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary JavaScript in a victim's browser session.

The vulnerability exists due to improper neutralization of input during web page generation in the datasource and dataset folder move dialog search highlighting logic when rendering stored folder names as HTML. A remote user can create a folder with a crafted name to execute arbitrary JavaScript in a victim's browser session.

User interaction is required: the victim must open the "Move to" dialog and type in the search box.


Remediation

Install update from vendor's website.

References