---
id: CVE-2026-46684
title: DataEase is an open source data visualization and analysis tool
summary: >-
  DataEase is an open source data visualization and analysis tool. Prior to
  2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter()
  pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token
  presence and le…
severity: none
cwe:
  - CWE-347
published: '2026-07-15'
updated: '2026-07-17'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46684'
references:
  - url: >-
      https://github.com/dataease/dataease/commit/3efda9d29c0df4300d43bb7874638e03060c3e2d
    label: security-advisories@github.com
  - url: 'https://github.com/dataease/dataease/releases/tag/v2.10.23'
    label: security-advisories@github.com
  - url: >-
      https://github.com/dataease/dataease/security/advisories/GHSA-gp6v-f7mm-458v
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00319
epssPercentile: 0.22119
ingestedAt: '2026-07-18T15:23:42.396Z'
---

## Overview

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to TokenUtils.validate(), which checks only token presence and length before userBOByToken(token) uses JWT.decode() without signature verification, allowing forged tokens with chosen uid and oid values to be accepted when licenseValid=true. This issue is fixed in version 2.10.23.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.