DataEase Vulnerability Allowing Unauthorized Access to User Resources
CVE-2026-82878

5.3MEDIUM

Key Information:

Vendor

Dataease

Status
Dataease
Vendor
CVE Published:
31 August 2026

What is CVE-2026-82878?

Versions of DataEase prior to 2.10.26 have a security weakness that permits authenticated users to bypass essential object-level authorization checks on geographic information, dashboard linkages, and the REST endpoints for chart details. This oversight may enable users to access, overwrite, or delete resources that do not belong to them, such as modifying map geometry or altering dashboard configurations. Attackers can exploit this flaw by manipulating request identifiers, gaining unauthorized access to sensitive data and functionality.

Affected Version(s)

dataease 0 < 2.10.26

dataease 2.10.26

References

https://github.com/dataease/dataease/security/advisories/...
vendor-advisory
https://github.com/dataease/dataease/commit/5fe46c489876d...
patch
https://github.com/dataease/dataease/releases/tag/v2.10.26
release-notes

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dikai Zou
.