{"id":"CVE-2026-82878","summary":"DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints","details":"DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete map geometry, modify dashboard linkages, and retrieve chart metadata and configuration for resources they do not own by supplying arbitrary identifiers in requests.","aliases":["GHSA-494p-38q6-9gx5"],"modified":"2026-09-02T08:08:04.871057Z","published":"2026-08-31T10:51:04.541Z","database_specific":{"cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82878.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82878.json"},{"type":"ADVISORY","url":"https://github.com/dataease/dataease/releases/tag/v2.10.26"},{"type":"ADVISORY","url":"https://github.com/dataease/dataease/security/advisories/GHSA-494p-38q6-9gx5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82878"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/dataease-before-2.10.26-missing-object-level-authorization-on-geographic-linkage-and-chart-endpoints"},{"type":"FIX","url":"https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb"},{"type":"PACKAGE","url":"https://github.com/dataease/dataease"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dataease/dataease","events":[{"introduced":"0"},{"fixed":"04129b006b2a51447fb15f5c32138f39a4fd4fec"},{"fixed":"5fe46c489876d5decdfcde36d20b1c618d472cbb"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.10.26"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v2.10.25","v2.10.24","v2.10.23","v2.10.22","v2.10.21","v2.10.20","v2.10.19","v2.10.18","v2.10.17","v2.10.16","v2.10.15","v2.10.14","v2.10.13","v2.10.12","v2.10.11","v2.10.10","v2.10.9","v2.10.8","v2.10.7","v2.10.6","v2.10.5","v2.10.4","v2.10.3","v2.10.2","v2.10.1","v2.10.0","v2.6.0","v2.3.0","v2.2.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82878.json","vanir_signatures_modified":"2026-09-02T08:08:04Z","vanir_signatures":[{"digest":{"function_hash":"308861408492612501024747186421365810581","length":470},"id":"CVE-2026-82878-10bd6b83","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb","target":{"function":"getVisualizationAllLinkageInfo","file":"core/core-backend/src/main/java/io/dataease/visualization/server/VisualizationLinkageService.java"},"deprecated":false},{"id":"CVE-2026-82878-20bc4923","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/manage/ChartViewManege.java","function":"getChart"},"deprecated":false,"digest":{"function_hash":"29914552168079640765655498919704973463","length":426}},{"target":{"file":"core/core-backend/src/main/java/io/dataease/map/manage/MapManage.java"},"deprecated":false,"digest":{"line_hashes":["49287714882051154432416489256397014705","34358002493343186069179798648479678236","81067607202247054250265706171184544867","199676221248704228981626067260340982861","274605309237970523967338630937238743947","52423769124084429820307108519706516325","239358123934838040331218872503138911240","291046150793777357629628708058284533440"],"threshold":0.9},"id":"CVE-2026-82878-30bedab2","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb"},{"signature_version":"v1","source":"https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb","target":{"file":"core/core-backend/src/main/java/io/dataease/visualization/server/VisualizationLinkageService.java","function":"updateLinkageActive"},"deprecated":false,"digest":{"function_hash":"57266468950201524607037660483020554608","length":284},"id":"CVE-2026-82878-386b8935","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb","target":{"file":"core/core-backend/src/main/java/io/dataease/visualization/server/VisualizationLinkageService.java","function":"removeLinkage"},"deprecated":false,"digest":{"function_hash":"318591258528285447829390736751368329253","length":216},"id":"CVE-2026-82878-57561b4c","signature_type":"Function"},{"digest":{"function_hash":"130801332481676827949783354853514168901","length":1275},"id":"CVE-2026-82878-5c308b3f","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb","target":{"file":"core/core-backend/src/main/java/io/dataease/visualization/server/VisualizationLinkageService.java","function":"saveLinkage"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb","target":{"function":"getViewLinkageGatherArray","file":"core/core-backend/src/main/java/io/dataease/visualization/server/VisualizationLinkageService.java"},"deprecated":false,"digest":{"function_hash":"293717909068924972116214688186168066016","length":376},"id":"CVE-2026-82878-5d969f90"},{"deprecated":false,"digest":{"line_hashes":["196520813483926132259486648535554257503","187436601319278377364574262983847490552","161740742372712358831148965981553746255","217292794997502717707613034494835706246","153160515774628225594720818510178762673","94968222597320966358830696449969943684","122624280197132109109656514509950278641","4262331966459915420082735513516864648","23283998209846159513251406482882361063","88927546988614803048925099003947134400","253354508081699937022323310436969210758","11303321944994142835807534425190649296","143837325128953876049523564633961455274","298668553739653402482315190596273201638","290535432890563455973928133361230358835","108809807213261093378108523669755291854","329200057584072745524668577361327731042","177384965526030861072529930870704604092","304368776265873505739557510823365285961","288611869378890724551303545751413089698","306595407847516420011401721783724384629","307329177713191881465036937973266744613","96911543587175395765777272840810931887","185752992256394489065127365250968949045","283328995257168760468872831674273608277","55314632538062335911114277577397193809","317757553912048966104148417082857673063","12182387879242480857347643775444428726","89260471412530541310566913724516160276","54149806438863004958294996169997939822","48689371552609126531512628151815850683"],"threshold":0.9},"id":"CVE-2026-82878-8d26fda7","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb","target":{"file":"core/core-backend/src/main/java/io/dataease/visualization/server/VisualizationLinkageService.java"}},{"target":{"file":"core/core-backend/src/main/java/io/dataease/visualization/server/VisualizationLinkageService.java","function":"getViewLinkageGather"},"deprecated":false,"digest":{"function_hash":"319191072550436039517411035269365771666","length":650},"id":"CVE-2026-82878-9301b5a7","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb"},{"source":"https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb","target":{"function":"deleteGeo","file":"core/core-backend/src/main/java/io/dataease/map/manage/MapManage.java"},"deprecated":false,"digest":{"function_hash":"161223797756350479378702861413536909908","length":554},"id":"CVE-2026-82878-9817f247","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"299553941835177152338220208867334073419","length":1299},"id":"CVE-2026-82878-b9106035","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb","target":{"file":"core/core-backend/src/main/java/io/dataease/map/manage/MapManage.java","function":"saveMapGeo"}},{"digest":{"line_hashes":["235269828016585128544138251452217485840","316283465290150274971341497660759645321","317545931771751554904075710611456844906","281461328741331216878280960035036630587","92071100307194027601670328832796150865","250689614680138335638602408264033768266","334726933417868593084171226018602237323","72337776553164384008395016689197947373","322180155688194067908155349245324404347","275734782816403056436638474313544643122","297970905515861039859483081298851793398","163657378752363461131277254314692420744","67962970146542616985896280784613567431","236874454435301834961368606167311651533","158836223455143896153300492823280169232","259112211192209611948398698993163516225","302581843918978188900461576938837149062","194851824113040275662042504209978421027","214514024782043764173368669560638412142","195890654100173170828806008171494857948","306846306448212766614858838893786108704","160568394846580714746512271980684656862","321009336269336240989042503073965774617","284039955685952920510119378894931819243"],"threshold":0.9},"id":"CVE-2026-82878-bb621129","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/manage/ChartViewManege.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb","target":{"file":"core/core-backend/src/main/java/io/dataease/chart/manage/ChartViewManege.java","function":"listByDQ"},"deprecated":false,"digest":{"function_hash":"35887566810516494145235916960779193948","length":2424},"id":"CVE-2026-82878-ceda3e75"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}]}