The /de2api/datasetData/previewSql endpoint in DataEase was found to omit the required @DePermit permission validation annotation before version 2.10.24. As a result, any authenticated user can submit a request with datasourceId set to -1, bypassing the intended authorization checks and gaining direct access to the internal engine database. The flaw permits the execution of arbitrary SQL statements, which the CVE description explicitly states allows read access to sensitive core data. While the description does not confirm that data can be modified, the ability to run arbitrary SQL indicates that modification could also be possible; based on the description, it is inferred that alteration of database contents may be achievable, although this is not explicitly stated. This missing authorization vulnerability (CWE-862) enables an attacker to compromise the confidentiality of internal data and potentially alter database contents if authorized SQL execution is performed.

Versions earlier than 2.10.24 of DataEase are affected. The vulnerability was fixed in the 2.10.24 release, and later versions are not impacted.

The CVSS score of 8.7 classifies this vulnerability as high severity, but the EPSS score of <1% suggests a low probability of exploitation under typical circumstances. The vulnerability is not listed in CISA KEV. Because the flaw is a missing authorization check, an attacker only needs valid authenticated credentials; no special privileges or network conditions beyond normal access to the API are required. Exploitation can be performed remotely over the API endpoint by anyone who can authenticate to the system, making the attack vector likely HTTP-based.