CVE-2026-82878

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.26

Description Authenticated users can access resources belonging to other users because object-level authorization checks are omitted on REST endpoints related to geographic information, dashboard linkage, and chart detail. By supplying arbitrary identifiers in requests, attackers can overwrite or delete map geometry, modify dashboard linkages, and retrieve chart metadata and configuration for resources they do not own.

Recommendations Update to version 2.10.26 or later.