CVE-2026-82879: DataEase Auth Bypass Vulnerability

CVE-2026-82879 Overview

CVE-2026-82879 is a broken access control vulnerability in DataEase, an open-source business intelligence and data visualization platform. Versions prior to 2.10.26 contain multiple defects in the sharing link module that permit ticket reuse, policy bypass, and unauthorized modification of other users' share tickets. The flaws stem from missing binding between tickets and share Universally Unique Identifiers (UUIDs), missing ownership checks on ticket management endpoints, and a LinkToken issuance path that ignores the ticketRequire policy. The classification maps to [CWE-863: Incorrect Authorization].

Critical Impact
Authenticated attackers can reuse valid tickets across unrelated shares, bypass mandatory ticket enforcement to obtain LinkToken values, and modify or delete other users' tickets, resulting in unauthorized data access and denial of service.

Affected Products

DataEase versions prior to 2.10.26
DataEase sharing link module (ShareTicketManage, XpackShareManage)
DataEase REST endpoints under /de2api/share/* and /de2api/ticket/*

Discovery Timeline

2026-08-31 - CVE-2026-82879 published to the National Vulnerability Database (NVD)
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82879

Vulnerability Analysis

The DataEase sharing link module exposes four distinct authorization defects that together allow authenticated users to bypass share access controls. First, ShareTicketManage.validateTicket, invoked by POST /de2api/share/proxyInfo, does not verify that a submitted ticket belongs to the requested share UUID. A ticket issued for share A can therefore be reused against share B.

Second, POST /de2api/share/validate issues a LinkToken after successful password verification without consulting the share's ticketRequire flag. This bypasses the policy that mandates ticket possession before token issuance.

Third, POST /de2api/ticket/saveTicket and POST /de2api/ticket/delTicket do not verify that the caller owns the underlying share. An authenticated user who obtains another user's ticket value can rebind, modify, or delete it, causing denial of service for the legitimate share owner.

Finally, GET /de2api/share/queryRelationByUserId/{uid} allows any authenticated user to enumerate share mappings belonging to other users, disclosing internal share relationships.

Root Cause

The root cause is missing authorization logic at the service layer. Tickets are treated as globally valid rather than as credentials scoped to a specific share UUID and owning user. Password validation and ticket enforcement are also decoupled, allowing the LinkToken path to skip the ticket requirement.

Attack Vector

Exploitation requires network access to the DataEase API and an authenticated low-privilege account. An attacker enumerates share mappings via queryRelationByUserId, obtains a valid ticket through any legitimate share, and replays it against a different share UUID via proxyInfo. Alternatively, the attacker calls share/validate with a known share password to receive a LinkToken even when ticket enforcement is configured.

java

// Patch: bind ticket creation to share UUID and verify owner
// Source: https://github.com/dataease/dataease/commit/fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db
@Transactional
public String saveTicket(TicketCreator creator) {
    String uuid = creator.getUuid();
    if (StringUtils.isBlank(uuid)) {
        DEException.throwException("uuid为必填参数");
    }
    QueryWrapper<XpackShare> shareQuery = new QueryWrapper<>();
    shareQuery.eq("uuid", uuid);
    shareQuery.eq("creator", AuthUtils.getUser().getUserId());
    if (ObjectUtils.isEmpty(xpackShareMapper.selectOne(shareQuery))) {
        DEException.throwException("无权操作此分享的Ticket");
    }
    String ticket = creator.getTicket();
    // ...
}

java

// Patch: enforce ticketRequire before issuing LinkToken in XpackShareManage
// Source: https://github.com/dataease/dataease/commit/fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db
XpackShare xpackShare = xpackShareMapper.selectOne(queryWrapper);
boolean valid = StringUtils.equals(xpackShare.getUuid(), uuid)
        && StringUtils.equals(xpackShare.getPwd(), pwd);
if (valid && !Boolean.TRUE.equals(xpackShare.getTicketRequire())) {
    generateLinkToken(xpackShare);
}
return valid;

Detection Methods for CVE-2026-82879

Indicators of Compromise

Requests to POST /de2api/share/proxyInfo where the submitted ticket does not match tickets issued for the requested share UUID.
Repeated GET /de2api/share/queryRelationByUserId/{uid} requests iterating across user IDs from a single authenticated session.
POST /de2api/ticket/saveTicket or POST /de2api/ticket/delTicket calls where the acting user is not the original creator of the referenced share.

Detection Strategies

Correlate LinkToken issuance events from /de2api/share/validate against shares configured with ticketRequire=true; any match on unpatched builds indicates policy bypass.
Baseline per-user ticket creation and deletion rates and alert on cross-user ticket modifications.
Inspect application logs for authenticated share enumeration patterns and unexpected 4xx-to-2xx transitions on ticket endpoints.

Monitoring Recommendations

Forward DataEase application and reverse-proxy access logs to a centralized analytics platform and retain them for at least 90 days.
Alert on any request bursts to /de2api/share/queryRelationByUserId/ with sequential uid values.
Track the DataEase build version reported by /de2api/ health endpoints to confirm patched deployments across environments.

How to Mitigate CVE-2026-82879

Immediate Actions Required

Upgrade all DataEase deployments to version 2.10.26 or later using the GitHub Release v2.10.26.
Rotate any existing share tickets and LinkToken values issued by vulnerable builds, since prior tokens may have been captured or replayed.
Audit share ownership records and delete unrecognized tickets created by non-owner accounts.

Patch Information

The vendor fix is delivered in commit fbbb0482 and shipped in DataEase 2.10.26. The patch adds UUID-to-share binding in ShareTicketManage, ownership checks on saveTicket and delTicket, and enforces the ticketRequire flag in XpackShareManage.validatePwd before generating a LinkToken. Details are published in the GitHub Security Advisory GHSA-9h54-39gh-5qfg and the VulnCheck DataEase Advisory.

Workarounds

Restrict network access to /de2api/share/* and /de2api/ticket/* endpoints to trusted internal networks until patching completes.
Disable the sharing link feature or remove public shares that rely on ticket enforcement for confidentiality.
Apply a reverse-proxy rule that blocks unauthenticated or non-owner requests to queryRelationByUserId, saveTicket, and delTicket.

bash

# Example NGINX rule to restrict ticket management endpoints to an internal CIDR
location ~ ^/de2api/(ticket/(saveTicket|delTicket)|share/queryRelationByUserId/) {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://dataease_backend;
}