Authenticated users can store arbitrary values for FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime in group-field binning definitions. The utility that transforms these values into SQL inserts the unvalidated strings directly into CASE expressions. As a result, the stored data can be executed as part of an unparameterized query when a chart references the field, allowing an attacker to read, modify, or delete data in the backend database and potentially disrupt service availability.

DataEase, an open source data visualization and analysis platform, is vulnerable in all releases before version 2.10.26. The flaw is tied to authenticated users who can create or modify group-field binning definitions within the application.

The CVSS score of 8.7 indicates a high severity vulnerability. No EPSS score is published, and the issue is not listed in the CISA KEV catalog. Exploitation requires valid user credentials; the attack vector is the application’s web interface. Once authenticated, an attacker can craft malicious values that are later executed during chart rendering, making this a significant threat to the confidentiality, integrity, and availability of the connected database.