The vulnerability is a classic SQL injection (CWE-89) that occurs when the application inserts user‑controlled datasource identifiers into metadata queries without proper validation or parameterization. Attackers with any authenticated account that has datasource access can manipulate schema, connection usernames, table names, or database names, causing the generated SQL to be altered and executed against the backend database under the application’s credentials. As a result, the attacker can read, modify, or delete data, and potentially disrupt availability.

The affected product is DataEase, an open‑source data visualization and analysis platform. The issue applies to all releases before the recent fix highlighted in the 2.10.27 tag. No explicit product version list is supplied beyond this reference, so all earlier releases lacking the patch are vulnerable.

The CVSS score is 8.7, classifying it as high severity. The EPSS score is not currently available, but the vulnerability can be exploited without any victim interaction, provided the attacker can log in with sufficient datasource permissions. Because the attacker does not need to co‑operate, the likelihood of exploitation is significant in environments where DBA credentials are heavily used by the application. Currently the issue is not listed in CISA’s KEV catalog.