CVE-2026-50030

DataEase: Arbitrary SQL execution in preview path (direct data disclosure)

Published Jul 15, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetDataApi.previewSql/previewSqlCheck through /de2api/datasetData/previewSql, accepts PreviewSqlDTO.sql, PreviewSqlDTO.datasourceId, and PreviewSqlDTO.isCross, then DatasetDataManage.previewSql stores decoded SQL in datasourceRequest.query and CalciteProvider.fetchResultField executes it with prepareStatement(...).executeQuery(), allowing arbitrary readable datasource tables to be queried and returned in preview responses. This issue is fixed in version 2.10.23.

Analysis

Technical impact

Affected Systems

The vulnerability exists in the DataEase open‑source analytics platform, affecting all releases prior to version 2.10.23. The exposed interface is /de2api/datasetData/previewSql and is available on every installation that has the preview feature enabled.

Risk and Exploitability

The CVSS score of 7.1 indicates a high‑risk data disclosure threat. The EPSS score is below 1%, suggesting a very low but non‑zero likelihood of exploitation in the wild, and the issue is not currently listed in the CISA KEV catalog. Attackers can leverage the preview API by sending a crafted HTTP request that includes malicious SQL; authentication requirements are not specified in the advisory, implying that a valid authenticated session or open endpoint may be needed. Successful exploitation would grant read access to any database table accessible by the underlying service account.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

dataease

affected

Version	Status	Constraints
`< 2.10.23`	affected	—

No data.

Vendor Product Versions

Dataease

Version	Status	Scheme	Platform
`[0,2.10.23)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade DataEase to version 2.10.23 or newer to eliminate the vulnerability.
Restrict access to the /de2api/datasetData/previewSql endpoint by configuring role‑based access control or disabling the preview feature altogether.
Apply network or application‑level controls to limit access to the API endpoint to trusted IP ranges or authenticated users.

Generated by OpenCVE AI on July 31, 2026 at 02:58 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.467% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/dataease/dataease/commit/22930a493d900fe3d8084b3dd4c0125abdb2a847
https://github.com/dataease/dataease/releases/tag/v2.10.23
https://github.com/dataease/dataease/security/advisories/GHSA-j4v5-5gcx-cvfc

History

Jul 18, 2026 2:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 15, 2026 10:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dataease Dataease dataease
Vendors & Products		Dataease Dataease dataease

Jul 15, 2026 7:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetDataApi.previewSql/previewSqlCheck through /de2api/datasetData/previewSql, accepts PreviewSqlDTO.sql, PreviewSqlDTO.datasourceId, and PreviewSqlDTO.isCross, then DatasetDataManage.previewSql stores decoded SQL in datasourceRequest.query and CalciteProvider.fetchResultField executes it with prepareStatement(...).executeQuery(), allowing arbitrary readable datasource tables to be queried and returned in preview responses. This issue is fixed in version 2.10.23.
Title		DataEase: Arbitrary SQL execution in preview path (direct data disclosure)
Weaknesses		CWE-89
References		https://github.com/dataease/dataease/commit/22930a493d900fe3d8084b3dd4c0125abdb2a847 https://github.com/dataease/dataease/releases/tag/v2.10.23 https://github.com/dataease/dataease/security/advisories/GHSA-j4v5-5gcx-cvfc
Metrics		cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`