CVE-2026-82878CWE-862broken-access-control

CVE-2026-82878

Medium · published August 31, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete map geometry, modify dashboard linkages, and retrieve chart metadata and configuration for resources they do not own by supplying arbitrary identifiers in requests.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00344 · 26.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-31T15:16Z
References (5)
https://github.com/dataease/dataease · [email protected]https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb · [email protected]https://github.com/dataease/dataease/releases/tag/v2.10.26 · [email protected]https://github.com/dataease/dataease/security/advisories/GHSA-494p-38q6-9gx5 · [email protected]https://www.vulncheck.com/advisories/dataease-before-2.10.26-missing-object-level-authorization-on-geographic-linkage-and-chart-endpoints · [email protected]
EPSS history
Timeline
  • 02 SEP 03:40Z
    EPSS moved — → 0%
    epss
  • 31 AUG 10:51Z
    DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints
    cvelistv5