Missing Authorization in DataEase - #VU140503
Published: July 30, 2026
Vulnerability identifier: #VU140503
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
DataEase
DataEase
Detailed vulnerability description
The vulnerability allows a remote user to modify or delete linkage configurations belonging to other users' dashboards.
The vulnerability exists due to improper access control in the linkage write interfaces when processing requests that supply dashboard and view identifiers. A remote user can send a specially crafted request using another user's dashboard identifiers to modify or delete linkage configurations belonging to other users' dashboards.
Exploitation requires knowledge of another user's dashboard ID.
Remediation
Install security update from vendor's website.