An incorrect authorization vulnerability in DataEase allows unauthenticated remote attackers to potentially access sensitive visualization data.

The application suffers from an incorrect authorization vulnerability (CWE-863). The vulnerability allows an attacker to bypass authorization checks without requiring any authentication, leading to unauthorized access to protected resources.

The ability for unauthenticated users to access data visualization tools poses a severe risk to data confidentiality. With a CVSS score of 8.7, this vulnerability could lead to the exposure of sensitive business intelligence or proprietary analytics, resulting in significant data leakage and potential regulatory non-compliance.

Immediate Action: Upgrade DataEase to version 2.10.24 or higher immediately to address the authorization bypass.

Proactive Monitoring: Review web access logs for unauthorized requests to sensitive endpoints or unexpected data retrieval patterns that do not correlate with known user activity.

Compensating Controls: Place the DataEase instance behind a Web Application Firewall (WAF) with rules configured to block unauthorized access attempts to administrative or data-querying API endpoints.

Public Exploit Available: false

The severity of this authorization bypass cannot be overstated, as it allows for unauthenticated data access. Organizations utilizing DataEase must prioritize the upgrade to version 2.10.24 to ensure that authorization controls are correctly enforced and to prevent unauthorized exposure of sensitive analytical data.