CVE-2026-46684

Deferred Deferred - Pending Action

Token Forgery in DataEase via JWT Signature Bypass

Publication date: 2026-07-15

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByToken(token) uses JWT.decode() without signature verification, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. This issue is fixed in version 2.10.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-17

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-46684

EUVD

EUVD-2026-44785

Affected Vendors & Products

Vendor	Product	Version / Range
dataease	dataease	2.10.23
dataease	dataease	to 2.10.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability in DataEase (prior to version 2.10.23) involves improper JWT token validation in the enterprise edition. The system fails to verify token signatures when a valid license is present, allowing attackers to forge tokens with chosen user IDs and organization IDs. This bypasses authentication and grants unauthorized access.

Detection Guidance

To detect this vulnerability, check if your DataEase instance is running a version prior to 2.10.23. Use commands like 'curl -s http://<target>/api/version' or inspect the application logs for version details. Additionally, monitor for unauthorized JWT tokens or unexpected file writes in /etc/periodic/15min.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the DataEase system by forging JWT tokens. Additionally, they could write malicious scripts to specific directories via Redshift JDBC parameters, leading to remote command execution (RCE) when the system executes those scripts periodically.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements under GDPR and HIPAA. Organizations using affected versions may face compliance violations, potential data breaches, and regulatory penalties due to insufficient access controls and authentication mechanisms.

Mitigation Strategies

Upgrade DataEase to version 2.10.23 or later to address the JWT token validation and arbitrary file write issues.

Hi! I’m here to help you understand CVE-2026-46684. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70