CVE-2026-50529

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50529
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50529.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50529
Aliases
  • GHSA-7287-qqj9-phr6
Published
2026-07-07T20:39:23.727Z
Modified
2026-08-12T16:09:43.217971Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
DataEase: Link Token Leakage Prior to Share Password/Ticket Validation
Details

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns X-DE-LINK-TOKEN before validating the share password or ticket, allowing unauthenticated attackers who know a protected share UUID to obtain a valid link token for subsequent share-related API calls even with missing or invalid credentials. This issue is fixed in version 2.10.24.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50529.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/dataease/dataease

Affected ranges

Type
GIT
Repo
https://github.com/dataease/dataease
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c4e85a981e53c95b1ea73757db31e3025efdc410
Fixed
fa0889fcff354966b66d037ad843b7b402dbc4ce
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.10.24"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v2.*
v2.10.0
v2.10.1
v2.10.10
v2.10.11
v2.10.12
v2.10.13
v2.10.14
v2.10.15
v2.10.16
v2.10.17
v2.10.18
v2.10.19
v2.10.2
v2.10.20
v2.10.21
v2.10.22
v2.10.23
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.10.7
v2.10.8
v2.10.9
v2.2.0
v2.3.0
v2.6.0

Database specific

vanir_signatures_modified 
"2026-08-12T16:09:43Z"
vanir_signatures 
[
    {
        "id": "CVE-2026-50529-0149fb47",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "336057147106189470587180789633302687776",
                "200750837523352628385530504659041148564",
                "308605732276903411049780019847883052516"
            ]
        },
        "source": "https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410",
        "target": {
            "file": "core/core-backend/src/main/java/io/dataease/chart/manage/ChartDataManage.java"
        }
    },
    {
        "id": "CVE-2026-50529-034c5de2",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "88657505393777267403168065677519704423",
                "304125552616686856106964670675875517682",
                "226352689303820491463935633337683412202",
                "4232285567114258055913734171723075826",
                "3261240736780047290880379143341812539",
                "112632260519089421241724344625174961693",
                "252586658655121994513572661585652360058",
                "146224760172958853475198843135816871974",
                "137116538316009889252019499330947702128",
                "98386165125840763936670804090720976331",
                "97923326642091653105116990883407424383",
                "48503112345176917398346450766491619330",
                "321302889189419206635122996320174219591",
                "340136312229506002682949420126535169091",
                "55896550651242087960977592723231025368",
                "300746717938899948189074656503020781101"
            ]
        },
        "source": "https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410",
        "target": {
            "file": "core/core-backend/src/main/java/io/dataease/share/manage/XpackShareManage.java"
        }
    },
    {
        "id": "CVE-2026-50529-43e74815",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 1996.0,
            "function_hash": "132208819045243424257392116101676363631"
        },
        "source": "https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410",
        "target": {
            "function": "match",
            "file": "sdk/common/src/main/java/io/dataease/utils/WhitelistUtils.java"
        }
    },
    {
        "id": "CVE-2026-50529-4b02c00b",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 1364.0,
            "function_hash": "314564105440012174325982895293537767650"
        },
        "source": "https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410",
        "target": {
            "function": "proxyInfo",
            "file": "core/core-backend/src/main/java/io/dataease/share/manage/XpackShareManage.java"
        }
    },
    {
        "id": "CVE-2026-50529-4c9e6362",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "191623686469529479333016814788194381292",
                "92071100307194027601670328832796150865",
                "30155011593928739331173858127573401071",
                "248749192729661637608891480960146641471",
                "309392244530204320104162129683863255241",
                "73200482658413736666883195293847889723",
                "34713086893696611112704605713647137188",
                "138036112288963211595735184576072136388",
                "236599232306584333406386689415424548129",
                "167715899480527387917303645606104944254",
                "67347210713260926187022464486812055329",
                "83548246470274568104886842364081504219"
            ]
        },
        "source": "https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410",
        "target": {
            "file": "core/core-backend/src/main/java/io/dataease/chart/manage/ChartViewManege.java"
        }
    },
    {
        "id": "CVE-2026-50529-57b051c8",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 11292.0,
            "function_hash": "75124312874434505383482655776012960850"
        },
        "source": "https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410",
        "target": {
            "function": "calcData",
            "file": "core/core-backend/src/main/java/io/dataease/chart/manage/ChartDataManage.java"
        }
    },
    {
        "id": "CVE-2026-50529-95117370",
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "317839926164366978157216758897435648366",
                "67949984463368737689165994254038945210",
                "264739904507314760455336068613047700594",
                "196536694368374362433837625509875536125"
            ]
        },
        "source": "https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410",
        "target": {
            "file": "sdk/common/src/main/java/io/dataease/utils/WhitelistUtils.java"
        }
    },
    {
        "id": "CVE-2026-50529-b240d27a",
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 529.0,
            "function_hash": "204098308977146832844542487357002299699"
        },
        "source": "https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410",
        "target": {
            "function": "validatePwd",
            "file": "core/core-backend/src/main/java/io/dataease/share/manage/XpackShareManage.java"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50529.json"