CVE-2026-82878— DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints
Quick assessment
Affected
dataease dataease
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 DataEase 2.10.26 之前的版本中，地理信息、仪表盘联动以及图表详情等 REST 接口缺失了对象级的权限校验，这使得经过身份验证的用户能够访问属于其他用户的资源。攻击者可以通过在请求中提供任意标识符，覆盖或删除地图几何图形、修改仪表盘联动设置，并获取其并不拥有的资源的图表元数据及配置。
Possible ATT&CK Techniques 1 AI
T1529 · System Shutdown/Reboot
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82878
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints
Source: CVE Program / CVE List V5
Vulnerability Description
DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete map geometry, modify dashboard linkages, and retrieve chart metadata and configuration for resources they do not own by supplying arbitrary identifiers in requests.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-82878
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82878
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-82878 (1)
Other References for CVE-2026-82878 (4)
-
-
🔗 Release v2.10.26 · dataease/dataease · GitHub release-notes
-
-
IV. Related Vulnerabilities
Same product: dataease
-
CVE-2026-82879
DataEase before 2.10.26 Access Control Bypass via Share Tick -
CVE-2026-45532
DataEase has a Path Traversal Vulnerability -
CVE-2026-49867
DataEase: Authenticated Stored XSS in DataEase Template Stat -
CVE-2026-46684
DataEase: Unauthorized Command Execution Vulnerability -
CVE-2026-45320
DataEase Data Dashboard SqlVariable transFilter Unfiltered S
Same vendor: dataease
-
CVE-2026-82879
DataEase before 2.10.26 Access Control Bypass via Share Tick -
CVE-2026-45532
DataEase has a Path Traversal Vulnerability -
CVE-2026-72743
SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-ht -
CVE-2026-49867
DataEase: Authenticated Stored XSS in DataEase Template Stat -
CVE-2026-46684
DataEase: Unauthorized Command Execution Vulnerability
Same weakness: CWE-862
-
CVE-2026-77966
Ebyte NA111-M Missing Authorization -
CVE-2026-19616
Information Disclosure in TBC Technology's KitLogistic -
CVE-2026-74010
WordPress bbPress plugin <= 2.6.14 - Broken Access Control v -
CVE-2026-82871
ToolJet before v3.16.208 Cross-Organization Data Read via Da -
CVE-2026-82660
Nodemailer jsonTransport bypasses disableFileAccess and disa
V. Comments for CVE-2026-82878
No comments yet