DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST… (CVE-2026-82878)

The vulnerability identified as CVE-2026-82878 affects DataEase versions prior to 2.10.26. It involves the omission of object-level authorization checks on REST endpoints handling geographic information, dashboard linkage, and chart detail. Authenticated users can exploit this flaw by providing arbitrary resource identifiers in requests, enabling unauthorized access to other users' resources. This includes the ability to overwrite or delete map geometry data, alter dashboard linkages, and access chart metadata and configuration. The CVSS v3.1 score is 6.3, indicating a medium severity with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and impacts on confidentiality, integrity, and availability.

Authenticated users can access and manipulate resources they do not own, including overwriting or deleting map geometry, modifying dashboard linkages, and retrieving chart metadata and configuration. This can lead to unauthorized data modification and information disclosure within the affected application.

A fix is available in DataEase version 2.10.26 and later, which addresses the missing object-level authorization checks. Users should upgrade to version 2.10.26 or later to remediate this vulnerability. No vendor advisory was provided to indicate alternative mitigations or temporary fixes.