CVE-2026-46684

UNKNOWN 0.0

DataEase: Unauthorized Command Execution Vulnerability

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByToken(token) uses JWT.decode() without signature verification, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. This issue is fixed in version 2.10.23.

CWE	CWE-347
Vendor	dataease
Product	dataease
Published	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for dataease dataease

Be the first to know when new unknown vulnerabilities affecting dataease dataease are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

dataease / dataease

< 2.10.23

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/dataease/dataease/security/advisories/GHSA-gp6v-f7mm-458v github.com: https://github.com/dataease/dataease/commit/3efda9d29c0df4300d43bb7874638e03060c3e2d github.com: https://github.com/dataease/dataease/releases/tag/v2.10.23