Vulnerability Description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetDataApi.previewSql/previewSqlCheck through /de2api/datasetData/previewSql, accepts PreviewSqlDTO.sql, PreviewSqlDTO.datasourceId, and PreviewSqlDTO.isCross, then DatasetDataManage.previewSql stores decoded SQL in datasourceRequest.query and CalciteProvider.fetchResultField executes it with prepareStatement(...).executeQuery(), allowing arbitrary readable datasource tables to be queried and returned in preview responses. This issue is fixed in version 2.10.23.
Related Weaknesses (CWE)
References
- https://github.com/dataease/dataease/commit/22930a493d900fe3d8084b3dd4c0125abdb2
- https://github.com/dataease/dataease/releases/tag/v2.10.23
- https://github.com/dataease/dataease/security/advisories/GHSA-j4v5-5gcx-cvfc
FAQ
What is CVE-2026-50030?
CVE-2026-50030 is a documented vulnerability. DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetDataApi.previewSql/previewSqlCheck through /de2api/datasetData/previewSql, accept...
How severe is CVE-2026-50030?
CVSS scoring is not yet available for CVE-2026-50030. Check NVD for updates.
Is there a patch for CVE-2026-50030?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.