Key points
- CVE-2026-104142 is rated High severity with a CVSS score of 8.7.
- Authenticated users can inject SQL via crafted dataset field binning definitions.
- The vulnerability is fixed in DataEase version 2.10.26.
DataEase, an open-source data visualization tool, contains a stored SQL injection flaw affecting versions prior to 2.10.26. The issue allows authenticated users to compromise backend databases through manipulated chart configurations.
What happened
The vulnerability, identified as CVE-2026-104142, carries a CVSS score of 8.7, classified as High severity according to the National Vulnerability Database. The flaw stems from insufficient validation within the Utils.transGroupFieldToSql function. This component processes field group binning definitions for datasets.
Authenticated users can submit crafted values for specific parameters, including FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, and FieldGroupDTO.endTime. These inputs are inserted directly into generated SQL CASE expressions without sanitisation. Consequently, the resulting SQL statements reach backend query execution engines when charts utilise the affected fields.
Why it matters
This stored SQL injection threatens the confidentiality, integrity, and availability of the configured backend database. Because the injection is stored, it persists within the application’s dataset definitions. Any subsequent rendering of a chart using the compromised field triggers the malicious SQL execution.
Organisations relying on DataEase for data analysis face significant risk if their backend databases contain sensitive information. The ability to execute arbitrary queries allows attackers to extract data, modify records, or disrupt database operations. The impact extends beyond the application layer to the underlying data infrastructure.
What happens next
- Identify all instances of DataEase running versions older than 2.10.26.
- Review dataset group-field binning definitions for unusual or crafted values.
- Monitor backend database logs for unexpected SQL execution patterns.
- Plan immediate deployment of version 2.10.26 to affected systems.
Patch priority
Teams usually prioritise systems exposed to untrusted user input or those connected to critical databases. Check whether your DataEase instances allow external users to create or modify dataset definitions. If so, these environments require immediate attention. Isolate affected systems if possible to limit potential data exfiltration while preparing updates. Verify that backup procedures are current before initiating any changes. Test the update in a non-production environment to ensure compatibility with existing datasets and custom configurations. Roll out the fix in stages, monitoring for errors or performance degradation after each batch.
Background: Data exfiltration
A data breach is an event where unauthorised access occurs. Data exfiltration is the subsequent transfer of that accessed information to an external destination. You can have a breach without exfiltration if the attacker is detected before copying files. You cannot have exfiltration without a prior breach of access controls.
Read the full guide: Difference Between Data Breach and Data Exfiltration: The Operational Truth
What to do and how to stay safe: DataEase
- Audit DataEase installations to confirm current version numbers against the fixed release.
- Restrict user permissions to prevent unauthorised creation or modification of dataset fields.
- Monitor database activity for anomalous query patterns that may indicate exploitation.
- Apply the vendor-provided update to version 2.10.26 as soon as operational constraints allow.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of DataEase are affected by CVE-2026-104142?
All versions of DataEase prior to 2.10.26 are affected by this vulnerability.
Is there a fix available for this SQL injection flaw?
Yes, the issue is fixed in DataEase version 2.10.26.
What is the severity rating of CVE-2026-104142?
The National Vulnerability Database rates the severity as High with a CVSS score of 8.7.
