CVE-2026-82879

Medium

Description

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another (ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo). The POST /de2api/share/validate endpoint issues a LinkToken after password verification without requiring a ticket, bypassing the 'ticket mandatory' policy. Additionally, the ticket create and delete endpoints (POST /de2api/ticket/saveTicket, POST /de2api/ticket/delTicket) lack share-ownership checks, allowing an authenticated user who knows another user's ticket to modify, rebind, or delete it (denial of service), and GET /de2api/share/queryRelationByUserId/{uid} allows authenticated users to enumerate other users' share mappings.

SeverityMedium

CVSS6.3

Exploit probability—

ProductDataease

PublishedAug 31, 2026

First seenAug 31, 2026

Weakness typeCWE-863Incorrect authorization

How to fix

Update

dataease dataease2.10.26 or later

Patches

github.com/dataease/dataease/commit/fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db

Vendor advisories

Affected products

Product	Affected versions	Fixed in
dataease dataease	v < 2.10.26	2.10.26

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.