PT-2026-56254

CVE-2026-57172

Published

2026-07-07

Updated

2026-07-08

Description by

CVSS 4.0

8.3

High

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.24

Description The ShareSecretManage component uses a hardcoded default share link signature key. An attacker who obtains a passwordless share for a resource and user can use the known key link-pwd-fit2cloud to forge linkToken JSON Web Tokens (JWTs). This allows the attacker to bypass TokenFilter verification and access backend resources as the share creator, even if the original share has been revoked.

Recommendations Update to version 2.10.24.

Exploitability

Exploit

Fix

Impacts

Researchers

Icysun

Vendors

Affected products

Weakness enumeration

CWE-798: Use of Hard-coded Credentials

CWE-321: Use of Hard-coded Cryptographic Key