CVE-2026-50030: DataEase: Arbitrary SQL execution in preview path (direct data disclosure)
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetDataApi.previewSql/previewSqlCheck through /de2api/datasetData/previewSql, accepts PreviewSqlDTO.sql, PreviewSqlDTO.datasourceId, and PreviewSqlDTO.isCross, then DatasetDataManage.previewSql stores decoded SQL in datasourceRequest.query and CalciteProvider.fetchResultField executes it with prepareStatement(...).executeQuery(), allowing arbitrary readable datasource tables to be queried and returned in preview responses. This issue is fixed in version 2.10.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataEaseto a version that resolves this vulnerability.Fixed in 2.10.23
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50030?
The severity of CVE-2026-50030 is rated at 62, indicating a moderate risk level.
How do I fix CVE-2026-50030?
To fix CVE-2026-50030, upgrade to DataEase version 2.10.23 or later.
What type of attack does CVE-2026-50030 enable?
CVE-2026-50030 allows for arbitrary SQL execution, leading to potential direct data disclosure.
Which versions of DataEase are affected by CVE-2026-50030?
CVE-2026-50030 affects DataEase versions prior to 2.10.23.
What is the impact of CVE-2026-50030 on data security?
CVE-2026-50030 can lead to unauthorized access and exposure of sensitive data through SQL injection.