{"id":"CVE-2026-53729","summary":"DataEase ExportCenter IDOR allows cross-user export task access","details":"DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, any authenticated user can download (/exportCenter/download/{id}), delete (/exportCenter/delete), retry (/exportCenter/retry/{id}), or generate download links (/exportCenter/generateDownloadUri/{id}) for export tasks belonging to other users by manipulating the task ID parameter, and the /exportCenter/download/{id} endpoint is whitelisted from authentication, allowing unauthenticated access to exported files. This issue is fixed in version 2.10.24.","aliases":["GHSA-9423-78gr-xjj5"],"modified":"2026-08-12T16:41:09.565351Z","published":"2026-07-07T20:23:08.560Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53729.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-639"]},"references":[{"type":"WEB","url":"https://github.com/dataease/dataease/releases/tag/v2.10.24"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53729.json"},{"type":"ADVISORY","url":"https://github.com/dataease/dataease/security/advisories/GHSA-9423-78gr-xjj5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53729"},{"type":"FIX","url":"https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dataease/dataease","events":[{"introduced":"0"},{"fixed":"57e90bdcc21c3fa2ec57184671603ad88a5b941b"},{"fixed":"fa0889fcff354966b66d037ad843b7b402dbc4ce"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.10.24"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v2.10.23","v2.10.22","v2.10.21","v2.10.20","v2.10.19","v2.10.18","v2.10.17","v2.10.16","v2.10.15","v2.10.14","v2.10.13","v2.10.12","v2.10.11","v2.10.10","v2.10.9","v2.10.8","v2.10.7","v2.10.6","v2.10.5","v2.10.4","v2.10.3","v2.10.2","v2.10.1","v2.10.0","v2.6.0","v2.3.0","v2.2.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53729.json","vanir_signatures_modified":"2026-08-12T16:41:09Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"169173322147835513551862823390184388579","length":454},"id":"CVE-2026-53729-0c8369df","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b","target":{"file":"core/core-backend/src/main/java/io/dataease/exportCenter/manage/ExportCenterManage.java","function":"deleteTask"}},{"source":"https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b","target":{"file":"sdk/common/src/main/java/io/dataease/utils/FileUtils.java"},"deprecated":false,"digest":{"line_hashes":["274753048184955018277428187694039216879","156538359047531764818988485298978090774","115095623261719411874786638326504157350","121387547099686079026032619326541301436","221493756039543088187211181824629663634","131146791832275181197620172945006344088","51551341456356990837967839030398703006","55405352666016835715314348186846216323","145656970534697405926253958063866251223","246287932547059068162964807124557184603","336093538004706478161212073945546735336","184450589340638828614160695518497718466","7350001354614640945034289940619059844","22228349675700443332728534371766461101","234076871446705610357119410873677806296","67746878512435932426754818570302673661","81831315588826091630079953611272188220","32969590400353726037600922436166975413","198127707859521760285808965951606147940","224994058951052107176446636369982274210","292831610406530240077625363616049520484","95007857152279816487369635798640132382","93090648803179078268163360215444125345","248062707284340868454107052309164774837","19837551494571244319893727697117363068","275737980145764789587682648588341015493","215999545263714615547082993661699456217","199353245767804997766177360999965863341","168696545729758373578913592875082964014","252057451184369828987574690780473531229","93116822742602721179381428962527499114","152089314009496578187583930411978750786","277416292014268306647732910911591817705","313073898947495931838032336713646739966","309375562389354581891680400723096938876","85128352897978082347532030838465492599","131841770713497826576431647000635720120","94547409338767548240895474349786165919","39272071776378563768104687819440765923","261159571482519367053458839561990557416","208544385643249711311119189702678316210","926859895532241238017725578333926142","39946921725665012825868720546159800618","5711931764620668016170286026088214905","109166452808120608784114344445974250134","185525594676239463511895541190058415944","30610260198905961010899613628314677647","159508125098543682415795951274350889914","58187439195347350729911258622306421482","202726547597068959557288431408291832262","284556514826703700146290792396041908945","111137217991427813369039190586340136449"],"threshold":0.9},"id":"CVE-2026-53729-0d267695","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"77494538332632384185313209746676832142","length":176},"id":"CVE-2026-53729-149c73de","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b","target":{"function":"download","file":"core/core-backend/src/main/java/io/dataease/exportCenter/manage/ExportCenterManage.java"}},{"id":"CVE-2026-53729-1e669da5","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b","target":{"file":"sdk/common/src/main/java/io/dataease/utils/FileUtils.java","function":"visitFile"},"deprecated":false,"digest":{"function_hash":"291261716119694906855914551258304632578","length":159}},{"target":{"file":"sdk/common/src/main/java/io/dataease/utils/FileUtils.java","function":"deleteDirectoryRecursivelyInternal"},"deprecated":false,"digest":{"function_hash":"86927137884523794216972286519054909136","length":720},"id":"CVE-2026-53729-23c04f43","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b"},{"source":"https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b","target":{"file":"sdk/common/src/main/java/io/dataease/utils/FileUtils.java","function":"deleteDirectoryRecursively"},"deprecated":false,"digest":{"function_hash":"218719327378696050010667827170917452204","length":452},"id":"CVE-2026-53729-3147e289","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"48185264178374384805392828975473308273","length":524},"id":"CVE-2026-53729-353ddec4","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b","target":{"file":"core/core-backend/src/main/java/io/dataease/exportCenter/manage/ExportCenterManage.java","function":"generateDownloadUri"},"deprecated":false},{"target":{"file":"core/core-backend/src/main/java/io/dataease/exportCenter/manage/ExportCenterManage.java"},"deprecated":false,"digest":{"line_hashes":["47685655835596645253263512462856285799","41080620963100354093348097431808083793","242837343933144194152273132402809534611","120190954927914815036413700349071479966","35508524470575428537868354938758401560","28462081331622119556809142053322720995","119453388931644461494948364476840677692","22020503104504027384248616624258862998","84967234788428059516864905653764611407","139432164571792421298214821938967242244","310970107599547911716646971468337486334","125287199241712856651447349960268783828","313699604163959744931316628134800850170","112720928393655702440049410079760177249","300655775385556712813105116041361227737","199852850955267850216886936944411908693","267590060084084217786398251313108920","334468702962322465161457702659470248124","269759468228760616104035861612658834255","335643708549065132981211073189418281392","121932378231304096213039001864137133850","220089277784738148133874718160628386651","57568017704879043119771472492457044704","150834076559438088304817165556460342460","202573678339962908958212054019152457315","34412983174383143121623632724740004553","220874395861016280571407197092758874945","297083566492562235011715046298725020438","62988741503888861328903124552412340098","276009097490672090516387081222533175120","258144042977087978617765205819375690542","18562359456361493522322260081358287747","316702293786837169639933811537198655908","295601526394921442906325029352135885373","290835515935709159705138859189435544658","96864710023441411212796377116286675804","10045697690772450950196026713512760521","106190487285130536492153521732448413820","189972573694241124190741748887280689485","314451684548100926938747129390624825111","264225851063772169846811288717551922983","104458482277961483395936466895187735746","168697656427876414980072708024135981395","46525702296873265881279349181912897580","201474933980872130965749559663100334320","284841928567863797285426564467208933900","167474262863374705287208161241772311588","330659957760822371578945959007429715289","63717661836184164533348286516419036166","292158815698030288632560167853401380328","25130932322063347222652969935391570038","172793133474424329611734356150160287940","13680093913829282585466132749178998646","289204551768028525132737197029019907474","299502649672851610447836419933816955360","268133536189628835869275448185350479024"],"threshold":0.9},"id":"CVE-2026-53729-3a955314","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b"},{"source":"https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b","target":{"file":"sdk/common/src/main/java/io/dataease/utils/FileUtils.java","function":"postVisitDirectory"},"deprecated":false,"digest":{"function_hash":"129469150870686529382273919103104574358","length":192},"id":"CVE-2026-53729-5923aa42","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-53729-7756976c","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b","target":{"file":"core/core-backend/src/main/java/io/dataease/exportCenter/manage/ExportCenterManage.java","function":"resolveExportTaskDirectory"},"deprecated":false,"digest":{"function_hash":"201584676915560639977829237898949881403","length":339}},{"deprecated":false,"digest":{"length":86,"function_hash":"323088270217614882363074791857352112090"},"id":"CVE-2026-53729-8046d2e0","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b","target":{"file":"core/core-backend/src/main/java/io/dataease/exportCenter/manage/ExportCenterManage.java","function":"delete"}},{"deprecated":false,"digest":{"function_hash":"236070961268574398789316056297290571089","length":190},"id":"CVE-2026-53729-82a3ece9","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b","target":{"file":"sdk/common/src/main/java/io/dataease/utils/FileUtils.java","function":"validateChildPath"}},{"id":"CVE-2026-53729-bbf85db4","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/57e90bdcc21c3fa2ec57184671603ad88a5b941b","target":{"file":"core/core-backend/src/main/java/io/dataease/exportCenter/manage/ExportCenterManage.java","function":"retry"},"deprecated":false,"digest":{"function_hash":"119710300688150146569311153264854700410","length":942}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}