CVE-2026-46684
Vulnerability Description
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByToken(token) uses JWT.decode() without signature verification, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. This issue is fixed in version 2.10.23.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-347
Source
NVD
Vendor
dataease
Product
dataease
Discussion (0)
Add Comment
No comments yet. Be the first!