CVE-2026-53730

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.24

Description The '/de2api/datasetData/previewSql' endpoint lacks the mandatory @DePermit permission validation annotation. This allows any authenticated user to set the datasourceId variable to -1, granting unauthorized access to the built-in engine database to execute arbitrary SQL statements and read sensitive core data.

Recommendations Update to version 2.10.24. Restrict access to the '/de2api/datasetData/previewSql' endpoint as a temporary mitigation.