Technical impact
DataEase’s ShareLink feature hardcodes the JWT signing secret "link-pwd-fit2cloud" in all releases before version 2.10.24. The likely attack vector is an attacker using an exposed passwordless share link to combine the known secret with a crafted payload, producing a valid linkToken that passes the TokenFilter validation. This permits the attacker to impersonate the original share creator and access protected backend resources, even if the share has been revoked. The flaw exemplifies hardcoded cryptographic material (CWE‑321) and use of default secrets (CWE‑798).
Affected Systems
All installations of the DataEase data visualization platform using the dataease product with a version older than 2.10.24 contain the flaw. Updating to version 2.10.24 or later removes the hardcoded signing key and eliminates the vulnerability.
Risk and Exploitability
The CVSS score of 8.3 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. However, because an attacker only needs a passwordless share link—something that can be achieved through normal sharing or by discovering publicly exposed URLs—the potential impact remains significant. Without remediation, the ability to forge JWTs and bypass authentication would grant an attacker unauthorized backend access.
