CVE-2026-50529

Impact

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns X-DE-LINK-TOKEN before validating the share password or ticket, allowing unauthenticated attackers who know a protected share UUID to obtain a valid link token for subsequent share-related API calls even with missing or invalid credentials. This issue is fixed in version 2.10.24.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/dataease/dataease/commit/c4e85a981e53c95b1ea73757db31e3025efdc410
• https://github.com/dataease/dataease/releases/tag/v2.10.24
• https://github.com/dataease/dataease/security/advisories/GHSA-7287-qqj9-phr6
• https://github.com/dataease/dataease/security/advisories/GHSA-7287-qqj9-phr6