CVE-2026-33207 - Vulnerability Analysis

Overview

DataEase <= 2.10.20 contains a SQL injection caused by improper sanitization of the tableName parameter in /datasource/getTableField endpoint, letting authenticated attackers execute arbitrary SQL commands via crafted API datasource registration.

Severity & Score

Impact

Authenticated attackers can execute arbitrary SQL commands, leading to sensitive database information disclosure.

Mitigation

Upgrade to version 2.10.21 or later.

References

• https://github.com/dataease/dataease/releases/tag/v2.10.21
• https://github.com/dataease/dataease/security/advisories/GHSA-pgh3-rgw3-xjmm

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 20, 2026

🟠 CVE-2026-33207 - High (8.8) DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /datasource/getTableField endpoint. The getTableFiledSql method in CalciteProvider.java incorporates the ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33207/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner