Medium severity · published Aug 31, 2026
CVE-2026-82878
DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete map geometry, modify dashboard linkages, and retrieve chart metadata and configuration for resources they do not own by supplying arbitrary identifiers in requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
dataease · dataease
before 2.10.26 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82878
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82878
github.com
https://github.com/dataease/dataease
github.com
https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb
github.com
https://github.com/dataease/dataease/releases/tag/v2.10.26
github.com
https://github.com/dataease/dataease/security/advisories/GHSA-494p-38q6-9gx5
www.vulncheck.com
https://www.vulncheck.com/advisories/dataease-before-2.10.26-missing-object-level-authorization-on-geographic-linkage-and-chart-endpoints
More from dataease
9.8
CVE-2026-33122
DataEase has SQL Injection via Datasource Management
9.8
CVE-2026-33082
DataEase: SQL Injection in v2 Dataset Export
9.8
CVE-2026-23958
DataEase Vulnerable to Brute-Force Attack on Admin JWT Secret Derived from Password that Enables Full Account Takeover
9.8
CVE-2025-64428
DataEase DB2 JNDI Vulnerability
9.8
CVE-2025-64164
DataEase is vulnerable to Oracle JNDI Injection