CVE-2026-75978 Overview
CVE-2026-75978 is a permission-related vulnerability affecting xianrendzw EasyReport up to version 2.0.17.0522_Beta. The flaw resides in the DataSourceController.add function within DataSourceController.java, part of the QueryerFactory component. Attackers can manipulate the queryerClass argument to trigger permission issues [CWE-266]. The vulnerability is remotely exploitable and requires low-privilege authentication. Public disclosure of the exploit has occurred, and the project maintainers were informed through an issue report but have not responded.
Critical Impact
A low-privileged remote attacker can manipulate the queryerClass parameter in DataSourceController.add to achieve improper privilege inheritance, affecting confidentiality, integrity, and availability of the EasyReport instance.
Affected Products
- xianrendzw EasyReport up to and including 2.0.17.0522_Beta
- Component: QueryerFactory
- File: DataSourceController.java
Discovery Timeline
- 2026-08-19 - CVE-2026-75978 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-75978
Vulnerability Analysis
The vulnerability exists in the DataSourceController.add method of the EasyReport reporting application. This controller accepts a queryerClass argument that determines which queryer implementation is instantiated by the QueryerFactory component. Insufficient permission enforcement on this argument allows an authenticated attacker to influence class selection in a way the application should restrict. The condition is classified under [CWE-266] (Incorrect Privilege Assignment).
The exploit has been publicly disclosed through VulDB and referenced in the project's GitHub issue tracker. The project has not responded to the disclosure, meaning no official patch exists at publication time. Refer to GitHub Issue #83 and the VulDB entry for CVE-2026-75978 for public tracking details.
Root Cause
The root cause is missing or inadequate authorization checks on the queryerClass parameter processed by DataSourceController.add. The QueryerFactory accepts caller-supplied class identifiers without validating that the requesting principal is authorized to select privileged queryer implementations. This creates an incorrect privilege assignment condition where lower-privileged users can influence sensitive backend behavior.
Attack Vector
An authenticated attacker with low privileges sends a crafted HTTP request to the EasyReport data source management endpoint that invokes DataSourceController.add. By manipulating the queryerClass argument, the attacker abuses the permission logic to gain access or behavior that should be restricted. Network reachability to the application is the only environmental prerequisite; no user interaction is required.
Because verified proof-of-concept code has not been published in a controlled form, refer to the GitHub PoC Repository and the VulDB vulnerability record #391893 for technical details on request structure and payload construction.
Detection Methods for CVE-2026-75978
Indicators of Compromise
- HTTP POST requests to EasyReport endpoints invoking DataSourceController.add with unexpected or non-standard queryerClass values.
- Application log entries showing data source creation events initiated by non-administrative accounts.
- Instantiation of queryer classes not aligned with the requesting user's assigned role.
Detection Strategies
- Enable verbose logging in EasyReport for the QueryerFactory component to capture class-loading events tied to user identity.
- Deploy a Web Application Firewall (WAF) rule that inspects requests to DataSourceController endpoints and blocks unexpected queryerClass parameter values.
- Correlate authentication logs with data source configuration changes to identify low-privileged accounts performing administrative actions.
Monitoring Recommendations
- Baseline expected queryerClass values used by legitimate administrators, then alert on deviations.
- Monitor outbound connections initiated by the EasyReport application server for anomalous database or service targets.
- Track configuration changes to EasyReport data sources and alert when changes originate from non-admin user IDs.
How to Mitigate CVE-2026-75978
Immediate Actions Required
- Restrict network access to EasyReport administrative endpoints, including DataSourceController routes, to trusted management networks only.
- Audit existing EasyReport user accounts and remove or downgrade accounts that do not require access to data source configuration functionality.
- Review recent data source additions and configuration changes for signs of abuse of the queryerClass argument.
Patch Information
No vendor patch is available at the time of publication. According to the disclosure, the project was informed through an issue report but has not responded. Track the EasyReport GitHub repository for future fixes and monitor the VulDB record for CVE-2026-75978 for updated remediation guidance.
Workarounds
- Place EasyReport behind an authenticating reverse proxy that enforces role-based access control on /dataSource/* paths.
- Apply WAF rules that allow only a strict allowlist of expected queryerClass values on requests to DataSourceController.add.
- If data source management is not actively required, disable or block the DataSourceController.add endpoint at the proxy layer until a vendor fix is released.
- Isolate the EasyReport application server so it cannot reach sensitive internal databases or services beyond those strictly required.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
