{
  "ticket_id": "CVE-2026-23958",
  "source": "cve",
  "cve_id": "CVE-2026-23958",
  "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23958",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-23958",
    "https://www.ox.security/blog/blog-dataease-cve-2026-23958-admin-takeover/",
    "https://www.ox.security/blog/from-auth-bypass-to-rce-a-4-vulnerability-exploit-chain-in-dataease/",
    "https://github.com/dataease/dataease",
    "https://github.com/dataease/dataease/commit/cac165e"
  ],
  "published_at": "2026-05-01",
  "severity": "high",
  "cwe": ["CWE-916", "CWE-287", "CWE-321"],
  "cvss": {
    "estimated_v3_1_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  },
  "labels": ["security", "authentication-bypass", "jwt", "md5", "dataease", "spring-boot", "rsac-2026"],
  "state": "published"
}