CVE-2025-27138

CRITICAL

DataEase < 2.10.6 - Unauthenticated Unauthorized Access via TokenFilter

Title source: llm
STIX 2.1

Description

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which may cause the risk of unauthorized access. The vulnerability has been fixed in v2.10.6. No known workarounds are available.

References (1)

Core 1
Core References

Scores

CVSS v3 9.8
EPSS 0.0054
EPSS Percentile 41.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-287 CWE-863
Status published
Products (1)
dataease/dataease < 2.10.6
Published Mar 13, 2025
Tracked Since Feb 18, 2026