CVE-2026-46684

CriticalCVSS 9.5/10Last modified Jul 17, 2026

Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByToken(token) uses JWT.decode() without signature verification, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. This issue is fixed in version 2.10.23.

Metrics

CVSS 4.0 9.5/10CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published
Jul 15, 2026
Last modified
Jul 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-466856.0RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFS_CORS_ALLOWED_ORIGINS is unset, the RustFS S3CVE-2026-466868.5Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/CVE-2026-466877.7Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template paCVE-2026-466886.9The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated reqCVE-2026-466898.7Kanidm is an identity management platform. Prior to version 1.9.3, a single unauthenticated GET to any /scim/v1/... endpoint with a ?filter=CVE-2026-466905.8unbounded_spsc is an "unbounded" extension of bounded_spsc_queue. In versions 0.2.0 and prior, sender::send pointer-as-value transmute causeCVE-2026-466916.5EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can sCVE-2026-466924.1ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an CVE-2026-466934.1ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, an CVE-2026-466946.5EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record CVE-2026-4669510.0Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run uCVE-2026-466963.3October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in