This vulnerability in xianrendzw EasyReport affects the DataSourceController.add function in the DataSourceController.java file of the QueryerFactory component. Manipulating the queryerClass argument leads to permission issues, potentially allowing unauthorized actions. The vulnerability is remotely exploitable. Although the issue was reported early to the project, no official remediation or patch has been released. Public exploit details have been disclosed.

The vulnerability allows remote attackers to manipulate permissions via the queryerClass argument, potentially leading to unauthorized access or actions within the EasyReport application. The medium CVSS score (5.3) reflects limited but notable impact due to permission issues. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. In the meantime, restricting access to the affected function or implementing additional access controls may reduce risk.