CVE-2026-82879: DataEase before 2.10.26 Access Control Bypass via Share Tickets
DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another (ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo). The POST /de2api/share/validate endpoint issues a LinkToken after password verification without requiring a ticket, bypassing the 'ticket mandatory' policy. Additionally, the ticket create and delete endpoints (POST /de2api/ticket/saveTicket, POST /de2api/ticket/delTicket) lack share-ownership checks, allowing an authenticated user who knows another user's ticket to modify, rebind, or delete it (denial of service), and GET /de2api/share/queryRelationByUserId/{uid} allows authenticated users to enumerate other users' share mappings.
Affected Software
Event History
Frequently Asked Questions
Who can exploit these flaws?
An attacker needs to be authenticated. Some actions also require knowledge of a valid ticket issued for another user's share, while share-mapping enumeration is available to authenticated users through the user-ID relation query endpoint.
Are deployments that require share tickets still affected?
Yes. The share validation endpoint can issue a LinkToken after password verification without requiring a ticket, bypassing the ticket-mandatory policy. A valid ticket for one share can also be reused against a different share because tickets are not bound to the target share UUID.
What can an authenticated attacker do with another user's ticket?
They can modify, rebind, or delete the ticket because the ticket creation and deletion endpoints do not enforce share ownership. Deleting or rebinding tickets can cause denial of service for the affected share.
How can teams identify exposure before patching?
Check whether the deployment is running a DataEase version earlier than 2.10.26. Review access to the affected share, ticket, and share-relation endpoints, particularly authenticated requests to /de2api/share/validate, /de2api/share/proxyInfo, /de2api/ticket/saveTicket, /de2api/ticket/delTicket, and /de2api/share/queryRelationByUserId/{uid}.