Medium 6.3Published Aug 31, 2026

CVE-2026-82879DataEase before 2.10.26 Access Control Bypass via Share Tickets

Updated under an hour ago (2026-10-19 07:00 UTC)

Does this affect you?

It affects dataease. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for dataease

Exploited in the last 30 days

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another (ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo). The POST /de2api/share/validate endpoint issues a LinkToken after password verification without requiring a ticket, bypassing the 'ticket mandatory' policy. Additionally, the ticket create and delete endpoints (POST /de2api/ticket/saveTicket, POST /de2api/ticket/delTicket) lack share-ownership checks, allowing an authenticated user who knows another user's ticket to modify, rebind, or delete it (denial of service), and GET /de2api/share/queryRelationByUserId/{uid} allows authenticated users to enumerate other users' share mappings.

CVSS: 6.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness (CWE): CWE-863
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Aug 31, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

dataease dataease dataease:dataease (from the name)	before 2.10.26; 2.10.26 not affected	CNA record

References

https://github.com/dataease/dataease/security/advisories/GHSA-9h54-39gh-5qfgvendor-advisory
https://github.com/dataease/dataease/commit/fbbb0482c4c10480c2dd4ecc050cd1e5c55b17dbpatch
https://github.com/dataease/dataease/releases/tag/v2.10.26release-notes
https://github.com/dataease/dataeaseproduct
https://www.vulncheck.com/advisories/dataease-before-2.10.26-access-control-bypass-via-share-ticketsthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.