AUGUST 25, 2026
Live Feed
Back to database
Case File

CVE-2026-50529

HIGH · CVSS 8.7 EPSS 0.29% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-07 · Last synced 2026-08-06

CyberRota Analysis

AI-Generated

The vulnerability in DataEase allows unauthenticated attackers to exploit the /de2api/share/proxyInfo interface to generate a valid link token without proper validation of credentials, provided they know the UUID of a protected share. This could lead to unauthorized access to sensitive data and API functionalities. Organizations using versions prior to 2.10.24 should prioritize upgrading to mitigate the risk of unauthorized data exposure.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-50529
Severity
HIGH
CVSS
8.7
EPSS
0.29%

Original NVD Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/share/proxyInfo share interface generates and returns X-DE-LINK-TOKEN before validating the share password or ticket, allowing unauthenticated attackers who know a protected share UUID to obtain a valid link token for subsequent share-related API calls even with missing or invalid credentials. This issue is fixed in version 2.10.24.