CVE-2026-53729 PUBLISHED

DataEase ExportCenter IDOR allows cross-user export task access

Assigner: GitHub_M
Reserved: 10.06.2026 Published: 07.07.2026 Updated: 08.07.2026

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, any authenticated user can download (/exportCenter/download/{id}), delete (/exportCenter/delete), retry (/exportCenter/retry/{id}), or generate download links (/exportCenter/generateDownloadUri/{id}) for export tasks belonging to other users by manipulating the task ID parameter, and the /exportCenter/download/{id} endpoint is whitelisted from authentication, allowing unauthenticated access to exported files. This issue is fixed in version 2.10.24.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.7

Product Status

Vendor dataease
Product dataease
Versions
  • Version < 2.10.24 is affected

References

Problem Types

  • CWE-639: Authorization Bypass Through User-Controlled Key CWE