Tes0T5

**Name of the Vulnerable Software and Affected Versions** DataEase versions prior to 2.10.24 **Description** Authenticated users can perform unauthorized actions on export tasks belonging to other users by manipulating the task ID parameter. Affected actions include downloading files via the '/exportCenter/download/{id}' endpoint, deleting tasks via '/exportCenter/delete', retrying tasks via '/exportCenter/retry/{id}', and generating download links via '/exportCenter/generateDownloadUri/{id}'. Additionally, the '/exportCenter/download/{id}' endpoint is whitelisted from authentication, which allows unauthenticated access to exported files. **Recommendations** Update to version 2.10.24.