CVE-2025-49001

CRITICAL 9.8CVE-2025-49001 · Published 03/06/2025 · updated 17/06/2026

In short

CVE-2025-49001 is a CRITICAL (CVSS 9.8) vulnerability affecting dataease (dataease).
Chance of exploitation in the next 30 days (EPSS): 22.0%, higher than 97.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
dataease dataease	`≤ 2.10.10`	No fix yet

Description

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully, so a user can use any secret to forge a JWT token. The vulnerability has been fixed in v2.10.10. No known workarounds are available.

References

dataease/dataease security advisory · Broken Link

More vulnerabilities in dataease

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

dataease

≤ 2.10.10

No fix yet

More vulnerabilities in dataease

See all →