Vulnerability Description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByToken(token) uses JWT.decode() without signature verification, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. This issue is fixed in version 2.10.23.
Related Weaknesses (CWE)
References
- https://github.com/dataease/dataease/commit/3efda9d29c0df4300d43bb7874638e03060c
- https://github.com/dataease/dataease/releases/tag/v2.10.23
- https://github.com/dataease/dataease/security/advisories/GHSA-gp6v-f7mm-458v
FAQ
What is CVE-2026-46684?
CVE-2026-46684 is a documented vulnerability. DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), wh...
How severe is CVE-2026-46684?
CVSS scoring is not yet available for CVE-2026-46684. Check NVD for updates.
Is there a patch for CVE-2026-46684?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.