PT-2026-60278 · Dataease · Dataease

Published 2026-07-15 · Updated 2026-07-15 · CVE-2026-46684

NVD

CVSS v4.0

9.5

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByToken(token) uses JWT.decode() without signature verification, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. This issue is fixed in version 2.10.23.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-46684

Affected Products

Dataease

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-46684 · Security Note
• https://github.com/dataease/dataease/commit/3efda9d29c0df4300d43bb7874638e03060c3e2d · Note
• https://github.com/dataease/dataease/security/advisories/GHSA-gp6v-f7mm-458v · Note
• https://github.com/dataease/dataease/releases/tag/v2.10.23 · Note