CVE-2025-32966 is a critical (CVSS 9.8) remote code execution flaw in DataEase, the open source business intelligence tool, before version 2.10.8. The record says authenticated users can complete code execution through the backend JDBC link. The fix is version 2.10.8. Upgrade and restrict access.
What's affected
DataEase versions prior to 2.10.8, per the CVE record. The project patched the issue in 2.10.8.
The description says authenticated users can reach code execution through the backend JDBC link, which is the feature that connects the tool to data sources. The vector in the record, however, shows no privileges required. Plan for the worse reading and treat any reachable instance as exposed.
BI tools hold connections to databases, so the host often has network paths and stored credentials that are worth more than the tool itself.
How to check if you're exposed
Find the DataEase version. It is shown in the web console, and for container installs you can list the image tag:
docker ps --format '{{.Names}} {{.Image}}'
Anything below 2.10.8 is affected. Then list who has accounts, especially ones created for demos, partners or former staff, and check whether the console is reachable from the internet.
Review the configured data sources for entries you do not recognize, since the JDBC connection settings are the feature involved.
What to do now
- Upgrade DataEase to 2.10.8 or later.
- Do not expose the console to the internet. Put it behind a VPN or an identity aware proxy.
- Remove unused accounts, and require strong credentials for the rest.
- Review data source definitions and connection strings for changes.
- Rotate the database credentials stored in DataEase if you suspect misuse, and limit those accounts to read access where possible.
Why it matters
NVD files the weakness under CWE-290 (Authentication Bypass by Spoofing). The advisory itself describes the effect as code execution through JDBC connection handling. JDBC drivers can be pointed at connection settings that make the driver do more than connect, so letting a user supply them is a sensitive power.
The general lesson is to treat connection strings entered in a console as untrusted input. A feature that lets an analyst point a tool at a database should not be able to run code on the tool's host.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Quick check
The text says authenticated, but the score says no privileges. Which is right?
The record contains both. Do not rely on the milder reading. Upgrade and restrict access either way.
Sources
Last reviewed: 18 October 2026.
