{"id":"CVE-2026-82879","title":"DataEase before 2.10.26 contains multiple access control defects in the sharing link module","summary":"DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another (ShareTicketManage.validate…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cwe":["CWE-863"],"published":"2026-08-31","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:18:59.270","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82879","references":[{"url":"https://github.com/dataease/dataease","label":"disclosure@vulncheck.com"},{"url":"https://github.com/dataease/dataease/commit/fbbb0482c4c10480c2dd4ecc050cd1e5c55b17db","label":"disclosure@vulncheck.com"},{"url":"https://github.com/dataease/dataease/releases/tag/v2.10.26","label":"disclosure@vulncheck.com"},{"url":"https://github.com/dataease/dataease/security/advisories/GHSA-9h54-39gh-5qfg","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/dataease-before-2.10.26-access-control-bypass-via-share-tickets","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00219,"epssPercentile":0.12688,"ingestedAt":"2026-09-08T21:11:12.288Z","slug":"CVE-2026-82879","body":"## Overview\n\nDataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another (ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo). The POST /de2api/share/validate endpoint issues a LinkToken after password verification without requiring a ticket, bypassing the 'ticket mandatory' policy. Additionally, the ticket create and delete endpoints (POST /de2api/ticket/saveTicket, POST /de2api/ticket/delTicket) lack share-ownership checks, allowing an authenticated user who knows another user's ticket to modify, rebind, or delete it (denial of service), and GET /de2api/share/queryRelationByUserId/{uid} allows authenticated users to enumerate other users' share mappings.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}