DataEase’s share mode chart data interface validates only that the sceneId supplied in the request matches the resourceId encoded in a share link token; it fails to confirm that the tableId and field identifiers in the request body belong to the shared resource. This weakness, identified as CWE‑639, allows an actor in possession of a valid share link token to replace dataset identifiers in a POST /de2api/chartData/getData request and retrieve data that should remain private, resulting in unauthorized data exposure.

All installations of the DataEase data visualization and analysis tool running a version earlier than 2.10.24 are vulnerable. The issue was remedied in release v2.10.24; later versions are considered safe.

The CVSS score of 7.1 indicates a high severity vulnerability, while an EPSS score of less than 1% reflects a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker needs only a valid share link token, which could be obtained through legitimate sharing or, based on the description, it is inferred that phishing methods may be used to acquire the token. With the token, the attacker simply alters the dataset identifiers in the POST request to the /de2api/chartData/getData endpoint and exfiltrates data that should remain unshared.