CVE-2026-50530

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50530
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50530.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50530
Aliases
  • GHSA-qcf4-345v-6vg9
Published
2026-07-07T20:41:07Z
Modified
2026-08-12T16:25:39Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets
Details

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the resourceId in the link token and fails to validate whether tableId and field IDs in the request body belong to the shared resource, allowing an attacker with a valid share link token to replace dataset identifiers and retrieve unauthorized data through POST /de2api/chartData/getData. This issue is fixed in version 2.10.24.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50530.json"
}
References

Affected packages

Git / github.com/dataease/dataease

Affected ranges

Type
GIT
Repo
https://github.com/dataease/dataease
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c4e85a981e53c95b1ea73757db31e3025efdc410
Fixed
fa0889fcff354966b66d037ad843b7b402dbc4ce
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.10.24"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v2.*
v2.10.0
v2.10.1
v2.10.10
v2.10.11
v2.10.12
v2.10.13
v2.10.14
v2.10.15
v2.10.16
v2.10.17
v2.10.18
v2.10.19
v2.10.2
v2.10.20
v2.10.21
v2.10.22
v2.10.23
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.10.7
v2.10.8
v2.10.9
v2.2.0
v2.3.0
v2.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50530.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "336057147106189470587180789633302687776",
                "200750837523352628385530504659041148564",
                "308605732276903411049780019847883052516"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-50530-0149fb47",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410",
        "target": {
            "file": "core/core-backend/src/main/java/io/dataease/chart/manage/ChartDataManage.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "88657505393777267403168065677519704423",
                "304125552616686856106964670675875517682",
                "226352689303820491463935633337683412202",
                "4232285567114258055913734171723075826",
                "3261240736780047290880379143341812539",
                "112632260519089421241724344625174961693",
                "252586658655121994513572661585652360058",
                "146224760172958853475198843135816871974",
                "137116538316009889252019499330947702128",
                "98386165125840763936670804090720976331",
                "97923326642091653105116990883407424383",
                "48503112345176917398346450766491619330",
                "321302889189419206635122996320174219591",
                "340136312229506002682949420126535169091",
                "55896550651242087960977592723231025368",
                "300746717938899948189074656503020781101"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-50530-034c5de2",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410",
        "target": {
            "file": "core/core-backend/src/main/java/io/dataease/share/manage/XpackShareManage.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "132208819045243424257392116101676363631",
            "length": 1996
        },
        "id": "CVE-2026-50530-43e74815",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410",
        "target": {
            "file": "sdk/common/src/main/java/io/dataease/utils/WhitelistUtils.java",
            "function": "match"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "314564105440012174325982895293537767650",
            "length": 1364
        },
        "id": "CVE-2026-50530-4b02c00b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410",
        "target": {
            "file": "core/core-backend/src/main/java/io/dataease/share/manage/XpackShareManage.java",
            "function": "proxyInfo"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "191623686469529479333016814788194381292",
                "92071100307194027601670328832796150865",
                "30155011593928739331173858127573401071",
                "248749192729661637608891480960146641471",
                "309392244530204320104162129683863255241",
                "73200482658413736666883195293847889723",
                "34713086893696611112704605713647137188",
                "138036112288963211595735184576072136388",
                "236599232306584333406386689415424548129",
                "167715899480527387917303645606104944254",
                "67347210713260926187022464486812055329",
                "83548246470274568104886842364081504219"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-50530-4c9e6362",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410",
        "target": {
            "file": "core/core-backend/src/main/java/io/dataease/chart/manage/ChartViewManege.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "75124312874434505383482655776012960850",
            "length": 11292
        },
        "id": "CVE-2026-50530-57b051c8",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410",
        "target": {
            "file": "core/core-backend/src/main/java/io/dataease/chart/manage/ChartDataManage.java",
            "function": "calcData"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "317839926164366978157216758897435648366",
                "67949984463368737689165994254038945210",
                "264739904507314760455336068613047700594",
                "196536694368374362433837625509875536125"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-50530-95117370",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410",
        "target": {
            "file": "sdk/common/src/main/java/io/dataease/utils/WhitelistUtils.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "204098308977146832844542487357002299699",
            "length": 529
        },
        "id": "CVE-2026-50530-b240d27a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410",
        "target": {
            "file": "core/core-backend/src/main/java/io/dataease/share/manage/XpackShareManage.java",
            "function": "validatePwd"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T16:25:39Z"