{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50530 exists.","fix":"No fix has been published for CVE-2026-50530 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-50530 is a high-severity missing authorization vulnerability in dataease, published on 7 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-50530 and fix it if it is affected.\n\nWhat it is: CVE-2026-50530 is a high-severity missing authorization vulnerability in dataease, published on 7 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50530 exists.\n\nAffected product: dataease. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-50530/ (Markdown: https://insights.sbomify.com/CVE-2026-50530/index.md)","id":"CVE-2026-50530","markdown":"https://insights.sbomify.com/CVE-2026-50530/index.md","name":"CVE-2026-50530","record":{"aliases":["GHSA-qcf4-345v-6vg9"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"DataEase visualization tool","requires_auth":"low_privilege","summary":"Attackers with valid share tokens can access unauthorized datasets by manipulating request parameters in DataEase.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.1,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key"}],"description":"DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the resourceId in the link token and fails to validate whether tableId and field IDs in the request body belong to the shared resource, allowing an attacker with a valid share link token to replace dataset identifiers and retrieve unauthorized data through POST /de2api/chartData/getData. This issue is fixed in version 2.10.24.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":false,"headline":"DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasets","id":"CVE-2026-50530","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"libvncclient Tight decoder has an attacker-controlled heap out-of-bounds write","id":"CVE-2026-50538"},"packages":[],"prev":{"headline":"DataEase: Link Token Leakage Prior to Share Password/Ticket Validation","id":"CVE-2026-50529"},"products":["dataease"],"published":"2026-07-07","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-07-08","vendors":["dataease"]},"summary":"Attackers with valid share tokens can access unauthorized datasets by manipulating request parameters in DataEase.","url":"https://insights.sbomify.com/CVE-2026-50530/"}