CVE-2025-27138

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which may cause the risk of unauthorized access. The vulnerability has been fixed in v2.10.6. No known workarounds are available.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-271395.4Combodo iTop is a web based IT service management tool. Versions prior to 2.7.12, 3.1.2, and 3.2.0 are vulnerable to cross-site scripting wh CVE-2025-27144.3A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functi CVE-2025-271409.8WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the CVE-2025-271416.5Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.4 CVE-2025-271428.8LocalSend is a free, open-source app that allows users to securely share files and messages with nearby devices over their local network wit CVE-2025-271436.1Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open CVE-2025-271446.6Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web En CVE-2025-271456.1copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is con CVE-2025-271464.3matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability whic CVE-2025-271478.2The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deploym CVE-2025-271488.8Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system tem CVE-2025-271492.7Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization