This vulnerability is an insecure direct object reference (IDOR) flaw that permits any authenticated user to supply a numeric task identifier to several ExportCenter endpoints, including download, delete, retry, and download link generation. The download endpoint is also exempt from authentication, enabling unauthenticated users to retrieve exported files once an ID is known. The result is unauthorized reading of other users’ exported data and the possibility of deleting such data, exposing sensitive information or causing data loss. Based on the description, it is inferred that the flaw arises from missing ownership checks and improper access control for the affected endpoints.

All installations of the DataEase open‑source data‑visualization platform running any version older than 2.10.24 are affected. The issue exists in every release before the security patch and applies regardless of deployment size or configuration.

The CVSS score of 8.7 indicates high severity, while the EPSS score of <1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector involves an authenticated attacker manipulating the task ID parameter, coupled with the unauthenticated download endpoint to elevate the attack surface. The combination of a simple input manipulation and a lack of authentication on the download route makes this flaw trivial for those with user credentials, thereby warranting prompt remediation.