CVE-2026-46684: DataEase: Unauthorized Command Execution Vulnerability
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByToken(token) uses JWT.decode() without signature verification, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. This issue is fixed in version 2.10.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEaseto a version that resolves this vulnerability.Fixed in 2.10.23
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46684?
CVE-2026-46684 has a risk rating of 76, indicating a significant potential impact.
How do I fix CVE-2026-46684?
To fix CVE-2026-46684, upgrade DataEase to version 2.10.23 or later.
What type of vulnerability is CVE-2026-46684?
CVE-2026-46684 is an unauthorized command execution vulnerability affecting DataEase.
What software is affected by CVE-2026-46684?
CVE-2026-46684 affects versions of DataEase prior to 2.10.23.
When was CVE-2026-46684 published?
CVE-2026-46684 was published on July 15, 2026.