CVE-2026-82878
Received Received - Intake

DataEase Geographic Information Authorization Bypass

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete map geometry, modify dashboard linkages, and retrieve chart metadata and configuration for resources they do not own by supplying arbitrary identifiers in requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82878
EUVD
EUVD-2026-68464

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dataease dataease to 2.10.26 (exc)
fit2cloud dataease to 2.10.26 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82878 is a missing authorization vulnerability in DataEase versions before 2.10.26. It affects geographic information, dashboard linkage, and chart detail REST endpoints. Authenticated users can access or modify resources belonging to other users by supplying arbitrary identifiers in requests. This allows overwriting or deleting map geometry, altering dashboard linkages, and retrieving chart metadata and configurations for resources they do not own.

Detection Guidance

To detect this vulnerability, check DataEase API endpoints for unauthorized access attempts. Monitor logs for requests to POST /de2api/geometry/save, POST /de2api/geometry/delete/{id}, POST /de2api/geometry/{id}/mapping, POST /de2api/linkage/saveLinkage, POST /de2api/chart/getChart/{id}, or POST /de2api/chart/listByDQ/{id}/{chartId} with arbitrary IDs. Verify if users can access or modify resources outside their permissions.

Impact Analysis

This vulnerability allows attackers with authenticated access to tamper with map resources, disrupt dashboard linkages, and access chart metadata or configurations of other users. While direct business data exposure is unlikely, it could lead to unauthorized modifications, data leakage, or service disruptions in shared environments.

Compliance Impact

This vulnerability could impact compliance by enabling unauthorized access to sensitive data, such as chart configurations or geographic information, which may contain personal or confidential details. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. Unauthorized access risks violating these regulations, potentially leading to legal and financial penalties.

Mitigation Strategies

Upgrade DataEase to version 2.10.26 or later immediately. Ensure all instances are updated to apply the missing authorization checks. Review user permissions and restrict access to sensitive endpoints until the upgrade is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82878. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart