DataEase's share mode chart data interface verifies only that the sceneId matches the resourceId encoded in a share link token. It does not confirm that the tableId and field identifiers supplied in the request body belong to the shared resource, creating a CWE‑639 weakness. This permits an attacker with a valid share link token to replace dataset identifiers in a POST /de2api/chartData/getData request and retrieve data that should remain private, thereby exposing sensitive information without authorization.

The flaw affects all installations of DataEase that run a version prior to 2.10.24. The vulnerability was addressed in release v2.10.24; later versions are considered safe.

The CVSS score of 7.1 indicates a high severity risk, while an EPSS score of less than 1% indicates a low current likelihood of exploitation. Possession of a share link token is the sole required foothold; the path to obtain such a token may involve legitimate use or phishing, but the latter is inferred from the need to acquire a token. Once the token is in hand, the attacker can simply alter the dataset identifiers in the request body to POST /de2api/chartData/getData and exfiltrate data that was intended to stay unshared. The vulnerability is not listed in the CISA KEV catalog and would not require additional privileges beyond the token.