CVE-2026-82878
- Source
- https://cve.org/CVERecord?id=CVE-2026-82878
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82878.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-82878
- Aliases
-
- GHSA-494p-38q6-9gx5
- Published
- 2026-08-31T10:51:04.541Z
- Modified
- 2026-09-02T08:08:04.871057Z
- Severity
-
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints
- Details
-
DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete map geometry, modify dashboard linkages, and retrieve chart metadata and configuration for resources they do not own by supplying arbitrary identifiers in requests.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82878.json", "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-862" ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82878.json
- https://github.com/dataease/dataease/releases/tag/v2.10.26
- https://github.com/dataease/dataease/security/advisories/GHSA-494p-38q6-9gx5
- https://nvd.nist.gov/vuln/detail/CVE-2026-82878
- https://www.vulncheck.com/advisories/dataease-before-2.10.26-missing-object-level-authorization-on-geographic-linkage-and-chart-endpoints
- https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb
- https://github.com/dataease/dataease
Affected packages
Git / github.com/dataease/dataease
Affected versions
v1.*
v1.0.0
v2.*
v2.10.0
v2.10.1
v2.10.10
v2.10.11
v2.10.12
v2.10.13
v2.10.14
v2.10.15
v2.10.16
v2.10.17
v2.10.18
v2.10.19
v2.10.2
v2.10.20
v2.10.21
v2.10.22
v2.10.23
v2.10.24
v2.10.25
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.10.7
v2.10.8
v2.10.9
v2.2.0
v2.3.0
v2.6.0
Database specific
vanir_signatures
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 470.0,
"function_hash": "308861408492612501024747186421365810581"
},
"id": "CVE-2026-82878-10bd6b83",
"target": {
"function": "getVisualizationAllLinkageInfo",
"file": "core/core-backend/src/main/java/io/dataease/visualization/server/VisualizationLinkageService.java"
},
"source": "https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb",
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 426.0,
"function_hash": "29914552168079640765655498919704973463"
},
"id": "CVE-2026-82878-20bc4923",
"target": {
"function": "getChart",
"file": "core/core-backend/src/main/java/io/dataease/chart/manage/ChartViewManege.java"
},
"source": "https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb",
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"49287714882051154432416489256397014705",
"34358002493343186069179798648479678236",
"81067607202247054250265706171184544867",
"199676221248704228981626067260340982861",
"274605309237970523967338630937238743947",
"52423769124084429820307108519706516325",
"239358123934838040331218872503138911240",
"291046150793777357629628708058284533440"
],
"threshold": 0.9
},
"id": "CVE-2026-82878-30bedab2",
"target": {
"file": "core/core-backend/src/main/java/io/dataease/map/manage/MapManage.java"
},
"source": "https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb",
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 284.0,
"function_hash": "57266468950201524607037660483020554608"
},
"id": "CVE-2026-82878-386b8935",
"target": {
"function": "updateLinkageActive",
"file": "core/core-backend/src/main/java/io/dataease/visualization/server/VisualizationLinkageService.java"
},
"source": "https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb",
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 216.0,
"function_hash": "318591258528285447829390736751368329253"
},
"id": "CVE-2026-82878-57561b4c",
"target": {
"function": "removeLinkage",
"file": "core/core-backend/src/main/java/io/dataease/visualization/server/VisualizationLinkageService.java"
},
"source": "https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb",
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1275.0,
"function_hash": "130801332481676827949783354853514168901"
},
"id": "CVE-2026-82878-5c308b3f",
"target": {
"function": "saveLinkage",
"file": "core/core-backend/src/main/java/io/dataease/visualization/server/VisualizationLinkageService.java"
},
"source": "https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb",
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 376.0,
"function_hash": "293717909068924972116214688186168066016"
},
"id": "CVE-2026-82878-5d969f90",
"target": {
"function": "getViewLinkageGatherArray",
"file": "core/core-backend/src/main/java/io/dataease/visualization/server/VisualizationLinkageService.java"
},
"source": "https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb",
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"196520813483926132259486648535554257503",
"187436601319278377364574262983847490552",
"161740742372712358831148965981553746255",
"217292794997502717707613034494835706246",
"153160515774628225594720818510178762673",
"94968222597320966358830696449969943684",
"122624280197132109109656514509950278641",
"4262331966459915420082735513516864648",
"23283998209846159513251406482882361063",
"88927546988614803048925099003947134400",
"253354508081699937022323310436969210758",
"11303321944994142835807534425190649296",
"143837325128953876049523564633961455274",
"298668553739653402482315190596273201638",
"290535432890563455973928133361230358835",
"108809807213261093378108523669755291854",
"329200057584072745524668577361327731042",
"177384965526030861072529930870704604092",
"304368776265873505739557510823365285961",
"288611869378890724551303545751413089698",
"306595407847516420011401721783724384629",
"307329177713191881465036937973266744613",
"96911543587175395765777272840810931887",
"185752992256394489065127365250968949045",
"283328995257168760468872831674273608277",
"55314632538062335911114277577397193809",
"317757553912048966104148417082857673063",
"12182387879242480857347643775444428726",
"89260471412530541310566913724516160276",
"54149806438863004958294996169997939822",
"48689371552609126531512628151815850683"
],
"threshold": 0.9
},
"id": "CVE-2026-82878-8d26fda7",
"target": {
"file": "core/core-backend/src/main/java/io/dataease/visualization/server/VisualizationLinkageService.java"
},
"source": "https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb",
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 650.0,
"function_hash": "319191072550436039517411035269365771666"
},
"id": "CVE-2026-82878-9301b5a7",
"target": {
"function": "getViewLinkageGather",
"file": "core/core-backend/src/main/java/io/dataease/visualization/server/VisualizationLinkageService.java"
},
"source": "https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb",
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 554.0,
"function_hash": "161223797756350479378702861413536909908"
},
"id": "CVE-2026-82878-9817f247",
"target": {
"function": "deleteGeo",
"file": "core/core-backend/src/main/java/io/dataease/map/manage/MapManage.java"
},
"source": "https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb",
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 1299.0,
"function_hash": "299553941835177152338220208867334073419"
},
"id": "CVE-2026-82878-b9106035",
"target": {
"function": "saveMapGeo",
"file": "core/core-backend/src/main/java/io/dataease/map/manage/MapManage.java"
},
"source": "https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb",
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"235269828016585128544138251452217485840",
"316283465290150274971341497660759645321",
"317545931771751554904075710611456844906",
"281461328741331216878280960035036630587",
"92071100307194027601670328832796150865",
"250689614680138335638602408264033768266",
"334726933417868593084171226018602237323",
"72337776553164384008395016689197947373",
"322180155688194067908155349245324404347",
"275734782816403056436638474313544643122",
"297970905515861039859483081298851793398",
"163657378752363461131277254314692420744",
"67962970146542616985896280784613567431",
"236874454435301834961368606167311651533",
"158836223455143896153300492823280169232",
"259112211192209611948398698993163516225",
"302581843918978188900461576938837149062",
"194851824113040275662042504209978421027",
"214514024782043764173368669560638412142",
"195890654100173170828806008171494857948",
"306846306448212766614858838893786108704",
"160568394846580714746512271980684656862",
"321009336269336240989042503073965774617",
"284039955685952920510119378894931819243"
],
"threshold": 0.9
},
"id": "CVE-2026-82878-bb621129",
"target": {
"file": "core/core-backend/src/main/java/io/dataease/chart/manage/ChartViewManege.java"
},
"source": "https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb",
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2424.0,
"function_hash": "35887566810516494145235916960779193948"
},
"id": "CVE-2026-82878-ceda3e75",
"target": {
"function": "listByDQ",
"file": "core/core-backend/src/main/java/io/dataease/chart/manage/ChartViewManege.java"
},
"source": "https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb",
"signature_version": "v1"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82878.json"
vanir_signatures_modified
"2026-09-02T08:08:04Z"