A flaw in the /de2api/share/proxyInfo endpoint of DataEase causes an X-DE-LINK-TOKEN to be generated and returned before the share password or ticket is verified. An attacker who knows the UUID of a protected share can request this endpoint without existing credentials, obtain a valid link token, and then use that token to issue further share‑related API calls on behalf of a legitimate user. The weakness is token creation without prior authorization checks (CWE‑863).

DataEase versions older than 2.10.24 are affected. The product is the open‑source data visualization and analysis platform from vendor dataease.

The CVSS score of 8.7 classifies the flaw as high severity. Remote unauthenticated HTTP requests to the vulnerable endpoint allow token acquisition once the share UUID is known. The EPSS score is below 1 %, indicating a very low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, indicating no public exploits are available yet. If exploited, an attacker could access or manipulate protected data through subsequent API calls that require a valid link token.