CVE-2026-57172

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57172
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57172.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57172
Aliases
  • GHSA-7cpg-f4cj-7pgm
Published
2026-07-07T20:33:26.555Z
Modified
2026-08-12T16:09:49.769278Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
DataEase: Hardcoded JWT Signing Secret in ShareLink
Details

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default share link signature key, allowing an attacker who can obtain a passwordless share for a resource and user to use the known key link-pwd-fit2cloud to forge linkToken JWTs, bypass TokenFilter verification, and access backend resources as the share creator even if the original share has been revoked. This issue is fixed in version 2.10.24.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-321",
        "CWE-798"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57172.json"
}
References

Affected packages

Git / github.com/dataease/dataease

Affected ranges

Type
GIT
Repo
https://github.com/dataease/dataease
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
356e83b518603f5612104760ced80aae8fc5d675
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.10.24"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v2.*
v2.2.0
v2.3.0
v2.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57172.json"
vanir_signatures 
[
    {
        "target": {
            "file": "core/core-backend/src/main/java/io/dataease/visualization/utils/VisualizationExcelUtils.java"
        },
        "deprecated": false,
        "source": "https://github.com/dataease/dataease/commit/356e83b518603f5612104760ced80aae8fc5d675",
        "id": "CVE-2026-57172-46f666d5",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "23880156135103336375353121923908083711",
                "215659146793781587865951333083498755509",
                "118185699087266584529111459482907476078",
                "230759015053106960406125095758250791026",
                "188500083333366591802579022767337804443",
                "49694892008866168056414945456600954732",
                "160089838311880119665606012364024230319",
                "224249666443103915547801649714999465405"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "exportExcel",
            "file": "core/core-backend/src/main/java/io/dataease/visualization/utils/VisualizationExcelUtils.java"
        },
        "deprecated": false,
        "source": "https://github.com/dataease/dataease/commit/356e83b518603f5612104760ced80aae8fc5d675",
        "id": "CVE-2026-57172-a0a33d7f",
        "signature_version": "v1",
        "digest": {
            "length": 2248.0,
            "function_hash": "291346208016947271547889063162533244320"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "core/core-backend/src/main/java/io/dataease/share/manage/ShareSecretManage.java"
        },
        "deprecated": false,
        "source": "https://github.com/dataease/dataease/commit/356e83b518603f5612104760ced80aae8fc5d675",
        "id": "CVE-2026-57172-d8a6bc94",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "158924138483832534825292320723065637220",
                "192225334371096382201567457789984556280",
                "92547728749243199551056717648740210208",
                "82262410447519045275687297665296375644",
                "196658839469730031378795918208045210538",
                "312642018426115730130880099903194984093",
                "109327912561360212225880920743134080463",
                "264114061888162754023038718837719396086",
                "51009282584636352279023247249777670315",
                "78567752203777934488366973113762226184",
                "114081908093586957178379005766518288996",
                "133198254462941398574010819432742791633",
                "71597611916602589997239619553257184292",
                "313878914023467737994606238166098698565",
                "74618201246919272861666055231503426228"
            ]
        },
        "signature_type": "Line"
    }
]
vanir_signatures_modified 
"2026-08-12T16:09:49Z"