Vulnerability Description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit permission validation annotation, allowing any authenticated user to specify datasourceId=-1, access the built-in engine database, execute arbitrary SQL statements, and read sensitive core data. This issue is fixed in version 2.10.24.
Related Weaknesses (CWE)
References
- https://github.com/dataease/dataease/commit/7b47af38b8fa017c9eecb00a4a4926466318
- https://github.com/dataease/dataease/security/advisories/GHSA-2jmq-vffm-4qmj
FAQ
What is CVE-2026-53730?
CVE-2026-53730 is a documented vulnerability. DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit permission validation annotation, allowing ...
How severe is CVE-2026-53730?
CVSS scoring is not yet available for CVE-2026-53730. Check NVD for updates.
Is there a patch for CVE-2026-53730?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.