{"id":"CVE-2026-82879","summary":"DataEase before 2.10.26 Access Control Bypass via Share Tickets","details":"DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another (ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo). The POST /de2api/share/validate endpoint issues a LinkToken after password verification without requiring a ticket, bypassing the 'ticket mandatory' policy. Additionally, the ticket create and delete endpoints (POST /de2api/ticket/saveTicket, POST /de2api/ticket/delTicket) lack share-ownership checks, allowing an authenticated user who knows another user's ticket to modify, rebind, or delete it (denial of service), and GET /de2api/share/queryRelationByUserId/{uid} allows authenticated users to enumerate other users' share mappings.","aliases":["GHSA-9h54-39gh-5qfg"],"modified":"2026-09-02T08:08:04.575219Z","published":"2026-08-31T10:51:05.222Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82879.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82879.json"},{"type":"ADVISORY","url":"https://github.com/dataease/dataease/releases/tag/v2.10.26"},{"type":"ADVISORY","url":"https://github.com/dataease/dataease/security/advisories/GHSA-9h54-39gh-5qfg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82879"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/dataease-before-2.10.26-access-control-bypass-via-share-tickets"},{"type":"FIX","url":"https://github.com/dataease/dataease/commit/fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db"},{"type":"PACKAGE","url":"https://github.com/dataease/dataease"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dataease/dataease","events":[{"introduced":"0"},{"fixed":"04129b006b2a51447fb15f5c32138f39a4fd4fec"},{"fixed":"fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.10.26"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v2.10.25","v2.10.24","v2.10.23","v2.10.22","v2.10.21","v2.10.20","v2.10.19","v2.10.18","v2.10.17","v2.10.16","v2.10.15","v2.10.14","v2.10.13","v2.10.12","v2.10.11","v2.10.10","v2.10.9","v2.10.8","v2.10.7","v2.10.6","v2.10.5","v2.10.4","v2.10.3","v2.10.2","v2.10.1","v2.10.0","v2.6.0","v2.3.0","v2.2.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82879.json","vanir_signatures_modified":"2026-09-02T08:08:04Z","vanir_signatures":[{"digest":{"function_hash":"332710256286340515987016844050918261353","length":272},"id":"CVE-2026-82879-0a7f4b13","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db","target":{"file":"core/core-backend/src/main/java/io/dataease/share/manage/ShareTicketManage.java","function":"deleteTicket"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db","target":{"file":"core/core-backend/src/main/java/io/dataease/share/manage/XpackShareManage.java","function":"validatePwd"},"deprecated":false,"digest":{"function_hash":"127725825303800260226079256152594735386","length":581},"id":"CVE-2026-82879-2bc973b5"},{"deprecated":false,"digest":{"line_hashes":["134917235231390776513520438257542129560","114646166780619243588326729669056278488","269288423085927705669435260845232655395","152166330769998611962655038280702019331","22758357250453903227735608901941792507","70831166203007179392879401137510003542","31951369636142811299091883172279217083","246468089769561767322507000787323397024","256875854562352562214491808606675150159","327773903801742417169236487585600721050"],"threshold":0.9},"id":"CVE-2026-82879-34422f37","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db","target":{"file":"core/core-backend/src/main/java/io/dataease/share/manage/XpackShareManage.java"}},{"digest":{"threshold":0.9,"line_hashes":["292805655873746413407571238514450309337","145078180049813446099969074259967950374","91401294132732873473316404795521543196","138919140113161482182074113458939950152","13229635780242305208117253438509342947","197263135666230937764238700704695668341","128558183781667919374255996881644917706","326166208023172631858349656610717189744","33896509320793244713487792938359040036","248432898163601179480159509345480639187","254781160586048382258449872853657873914","126850778631163069987895604541686467900"]},"id":"CVE-2026-82879-963bedba","signature_type":"Line","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db","target":{"file":"core/core-backend/src/main/java/io/dataease/share/manage/ShareTicketManage.java"},"deprecated":false},{"digest":{"length":1052,"function_hash":"130332672531175506017382009034382577377"},"id":"CVE-2026-82879-97188a7e","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db","target":{"file":"core/core-backend/src/main/java/io/dataease/share/manage/ShareTicketManage.java","function":"saveTicket"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"200161447384491699982499460254666331616","length":829},"id":"CVE-2026-82879-9ee0947c","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db","target":{"file":"core/core-backend/src/main/java/io/dataease/share/manage/ShareTicketManage.java","function":"validateTicket"}},{"deprecated":false,"digest":{"function_hash":"250214140558301874927256474277055943159","length":392},"id":"CVE-2026-82879-b98330f2","signature_type":"Function","signature_version":"v1","source":"https://github.com/dataease/dataease/commit/fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db","target":{"file":"core/core-backend/src/main/java/io/dataease/share/manage/XpackShareManage.java","function":"queryRelationByUserId"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}]}