CVE-2026-53729

HighCVSS 8.7/10Last modified Jul 8, 2026

Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, any authenticated user can download (/exportCenter/download/{id}), delete (/exportCenter/delete), retry (/exportCenter/retry/{id}), or generate download links (/exportCenter/generateDownloadUri/{id}) for export tasks belonging to other users by manipulating the task ID parameter, and the /exportCenter/download/{id} endpoint is whitelisted from authentication, allowing unauthenticated access to exported files. This issue is fixed in version 2.10.24.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jul 7, 2026
Last modified: Jul 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-53738.4An issue that allowed all-organization administrators to promote accounts to superuser status has been resolved. This is an instance of CWE-CVE-2026-537308.7DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the man CVE-2026-537364.3Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handler that lacks nonce v CVE-2026-537376.1Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page. Attackers controlli CVE-2026-537388.1Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler. Att CVE-2026-537394.3Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notice handler, which ver CVE-2026-53745.8An issue that allowed MCP agents to access remediation and asset information from outside of the authorized organization scope has been reso CVE-2026-537405.4Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers CVE-2026-537415.4Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding. Because CVE-2026-537425.4Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. A CVE-2026-53752.7An issue that could allow a user with access to a credential to view sensitive fields through an API response has been resolved. This is an CVE-2026-537518.7DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation logic can be bypassed