DataEase before 2.10.26 contains multiple access control defects in the sharing link module. (CVE-2026-82879)

DataEase before version 2.10.26 contains several access control defects in its sharing link module. Tickets issued for one share can be reused against others because they are not bound to the target share UUID. The endpoint POST /de2api/share/validate issues a LinkToken after password verification without requiring a ticket, bypassing the intended 'ticket mandatory' policy. The ticket creation and deletion endpoints (POST /de2api/ticket/saveTicket and POST /de2api/ticket/delTicket) lack checks to verify share ownership, allowing authenticated users who know another user's ticket to modify, rebind, or delete it, potentially causing denial of service. Furthermore, the GET /de2api/share/queryRelationByUserId/{uid} endpoint allows authenticated users to enumerate share mappings of other users. These vulnerabilities are categorized under CWE-863 (Incorrect Authorization) and have a CVSS 3.1 score of 6.3 (medium severity).

The vulnerabilities allow authenticated users to bypass access controls, reuse tickets across different shares, obtain LinkTokens without proper ticket validation, modify or delete tickets belonging to other users, and enumerate share mappings. This can lead to unauthorized information disclosure, unauthorized modification of share tickets, and denial of service conditions affecting share access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. In the meantime, restrict access to the sharing link module endpoints to trusted users and consider additional access controls or monitoring to detect misuse of share tickets.