CVE-2026-82879 DataEase before 2.10.26 Access Control Bypass via Share Tickets

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo. The POST...

CVE-2026-82879

DataEase before 2.10.26 contains multiple access control defects in its sharing link module. Tickets are not bound to the target share UUID, allowing a valid ticket issued for one share to be reused against another via ShareTicketManage.validateTicket (POST /de2api/share/proxyInfo). Additionally,...