CVE-2026-82878: DataEase Authorization Bypass Vulnerability

CVE-2026-82878 Overview

CVE-2026-82878 is a broken access control vulnerability in DataEase versions before 2.10.26. The application omits object-level authorization checks on several REST endpoints, including geographic information, dashboard linkage, and chart detail APIs. Authenticated users can supply arbitrary resource identifiers to access, modify, or delete objects owned by other users. The flaw maps to CWE-862: Missing Authorization.

Critical Impact

Any authenticated DataEase user can overwrite or delete map geometry, tamper with dashboard linkages, and read chart metadata and configuration belonging to other tenants without administrative privileges.

Affected Products

• DataEase versions prior to 2.10.26
• Geographic information (map geometry) REST endpoints
• Dashboard linkage and chart detail REST endpoints

Discovery Timeline

• 2026-08-31 - CVE-2026-82878 published to NVD
• 2026-08-31 - Last updated in NVD database
• DataEase v2.10.26 released with fix commit 5fe46c4

Technical Details for CVE-2026-82878

Vulnerability Analysis

DataEase is an open source business intelligence and data visualization platform. Multiple backend REST controllers accept resource identifiers from client requests and act on them without verifying that the caller owns or is authorized to access the target object. The affected surfaces include the map geometry APIs in MapManage, chart detail and metadata endpoints in ChartViewManege, and dashboard linkage endpoints. An authenticated attacker can enumerate or guess identifiers and issue direct requests against resources belonging to other users, resulting in unauthorized read, modification, and deletion.

Root Cause

The controllers did not enforce object-level permission checks before executing privileged operations. Administrative actions such as saveMapGeo executed for any authenticated caller because there was no AuthUtils.isSysAdmin() guard, and chart or linkage handlers dispatched on user-supplied IDs without a BusiPerCheckDTO authorization check.

Attack Vector

Exploitation requires network access to the DataEase application and valid low-privilege credentials. The attacker sends crafted HTTP requests to the vulnerable endpoints, substituting identifiers for resources owned by another user. No user interaction is required, and the request pattern matches legitimate API traffic.

// Patch excerpt from MapManage.java in commit 5fe46c4
@CacheEvict(cacheNames = WORLD_MAP_CACHE, key = "'world_map'")
@Transactional
public void saveMapGeo(GeometryNodeCreator request, MultipartFile file) {
    if (!AuthUtils.isSysAdmin()) {
        DEException.throwException(Translator.get("i18n_no_permission"));
    }
    if (ObjectUtils.isEmpty(request)) {
        DEException.throwException("geometry request is require");
    }
}

Source: GitHub Commit 5fe46c4. The fix adds a system-administrator check to saveMapGeo and introduces BusiPerCheckDTO and AuthEnum imports in ChartViewManege.java to enforce per-object authorization on chart endpoints.

Detection Methods for CVE-2026-82878

Indicators of Compromise

• Authenticated HTTP requests to map geometry, chart detail, or dashboard linkage endpoints originating from non-administrative user sessions.
• Successful POST, PUT, or DELETE operations against map geometry APIs by accounts that are not system administrators.
• Requests where the resource identifier in the URL or body does not match resources owned by the authenticated principal.

Detection Strategies

• Correlate DataEase application logs with the internal ownership database to flag API calls where the caller does not own the referenced object.
• Alert on any non-admin invocation of geometry write operations such as saveMapGeo and its delete counterpart.
• Monitor for sequential enumeration of chart, dashboard, or geometry IDs from a single authenticated session.

Monitoring Recommendations

• Enable verbose access logging on the DataEase core-backend REST layer and forward logs to a centralized analytics platform.
• Baseline normal per-user access patterns for chart and dashboard APIs and alert on deviations.
• Track HTTP 200 responses on endpoints that historically returned 403 for the same account.

How to Mitigate CVE-2026-82878

Immediate Actions Required

• Upgrade DataEase to version 2.10.26 or later, which contains commit 5fe46c4 and restores object-level authorization checks.
• Audit user accounts and revoke unnecessary privileges to reduce the population of authenticated callers.
• Review recent map geometry, dashboard linkage, and chart configuration changes for unauthorized modifications and restore from backup where needed.

Patch Information

The fix is delivered in GitHub Release v2.10.26. Technical details are documented in the GitHub Security Advisory GHSA-494p-38q6-9gx5 and the VulnCheck Advisory on DataEase. Source code changes are visible in GitHub Commit 5fe46c4.

Workarounds

• Restrict network access to the DataEase application to trusted users through a VPN or reverse proxy access control list until the upgrade is applied.
• Disable or block the affected map geometry, dashboard linkage, and chart detail endpoints at the reverse proxy for non-administrator accounts.
• Rotate API tokens and session credentials for any account that may have been used to probe the affected endpoints.

# Example reverse proxy rule to block non-admin access to geometry endpoints
# nginx snippet - deny writes to map geometry API until DataEase is upgraded
location ~ ^/de2api/map/(saveMapGeo|deleteMapGeo) {
    deny all;
    return 403;
}