CVE-2025-49001 is a critical authentication flaw (CVSS 9.8) in DataEase, the open source business intelligence tool. Secret verification does not take effect, so a user can sign a JWT with any secret and be accepted. The advisory lists 2.10.10 as the fixed version, and no workaround is known.
What's affected
The CVE record says DataEase versions prior to 2.10.10 are affected. The GitHub advisory lists the Maven package io.dataease with affected versions up to and including 2.10.8 and a patched version of 2.10.10. Where the two differ, treat anything below 2.10.10 as vulnerable.
The advisory states that no known workarounds exist. That makes the upgrade the only real fix, and it makes network exposure the main variable in how urgent it is.
How to check if you're exposed
Find the version of every DataEase instance you run. The version is shown in the product's interface and in the image or package you deployed. If you run it as a container, list the image tags in use:
docker ps --format "{{.Names}} {{.Image}}" | grep -i dataease
Compare the tag to 2.10.10. Anything older is affected. If you build DataEase from source or ship it inside another product, check your build files for the io.dataease artifacts and their versions.
Then check who can reach the service. A BI tool that is only reachable from an internal network is a smaller target than one published on the internet. The CVSS vector in the record lists a network attack vector, low complexity and no privileges required.
What to do now
- List every DataEase deployment, including test and analyst-owned copies that hold real connection details.
- Upgrade to 2.10.10 or later. A later advisory in this series names 2.10.11 as the fix for a separate issue, so plan to land on the newest release you can.
- Put the service behind a VPN or an allow list until the upgrade is done.
- Rotate database credentials and API secrets that were stored as data sources in DataEase if the instance was exposed.
- Review access logs and the audit trail for logins or API calls you cannot attribute to a real person.
Why it matters
The weakness is improper authentication, filed as CWE-287. A JWT is supposed to prove that the server issued it, by means of a signature made with a secret only the server holds. If the check for that signature is not enforced, the token proves nothing, and the person holding it can claim any identity.
In a BI platform that matters a great deal, because the application holds connections to production databases. The advisory describes this flaw in the same context as the other DataEase issues published on the same day, where an attacker with a forged token goes on to abuse a data source connection. This CVE is not on the CISA Known Exploited Vulnerabilities list, and the advisory does not report exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can I mitigate this without upgrading?
The advisory says no known workarounds are available. Restricting network access reduces exposure, but it does not fix the flaw.
Is the fix in 2.10.10 enough?
It fixes this CVE. Separate DataEase advisories name 2.10.11 as the fix for another critical issue, so aim for 2.10.11 or newer.
Sources
Last reviewed: 18 October 2026.
