CVE-2026-53729 | BDVDB-2026-346002 Detail

Description#

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, any authenticated user can download (/exportCenter/download/{id}), delete (/exportCenter/delete), retry (/exportCenter/retry/{id}), or generate download links (/exportCenter/generateDownloadUri/{id}) for export tasks belonging to other users by manipulating the task ID parameter, and the /exportCenter/download/{id} endpoint is whitelisted from authentication, allowing unauthenticated access to exported files. This issue is fixed in version 2.10.24.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-07Record published in the CVE List.
2. Version 22026-07-08Most recent update recorded in the CVE List.