Critical· 9.5official fix available
CVE-2026-46684
DataEase, a data visualization and analysis tool, has a flaw in how it handles security tokens. This allows an attacker to create fake tokens with custom user IDs to bypass security checks.
publishedJul 16, 2026
last modifiedJul 17, 2026
sourcesNVD
severity · cvss
9.5
critical · how bad it is
exploitation · epss
<1%
9th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 18, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Users of DataEase versions prior to 2.10.23.
02
Real-world impact
An attacker could gain unauthorized access to the system by forging security tokens, potentially allowing them to impersonate users and access sensitive data.
03
Why this severity
The critical score reflects that an attacker can remotely exploit this flaw without needing special privileges or user interaction to gain high-level access.
04
What to do about it
official fix available
recommended steps
- 01Upgrade DataEase to version 2.10.23 or later.
NVD-referenced vendor advisory
05
Timeline
- Jul 16, 2026 · 18d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 19, 2026 · 15d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Attack requirementsPresent
Privileges requiredNone
User interactionNone needed
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →