An unauthenticated authorization bypass vulnerability in DataEase exposes sensitive data to unauthorized external actors.

This vulnerability is an Authorization Bypass Through User-Controlled Key (CWE-639) that allows an unauthenticated attacker to manipulate parameters to access data they are not authorized to view.

The ability for an unauthenticated user to bypass authorization checks poses a severe risk to data confidentiality. With a CVSS score of 8.7, this vulnerability could lead to the unauthorized exposure of proprietary data, potentially resulting in significant reputational damage and regulatory non-compliance.

Immediate Action: Upgrade DataEase to version 2.10.24 or later immediately.

Proactive Monitoring: Monitor server access logs for unusual patterns of API requests or attempts to access resources using incremented or modified identifiers.

Compensating Controls: Implement strict network-level access controls to limit exposure of the DataEase instance to untrusted networks until the patch is applied.

Public Exploit Available: false

Given the critical nature of authorization bypass flaws, immediate patching is required. Organizations should prioritize updating their DataEase deployments to version 2.10.24 to eliminate this high-severity risk.