Improper Authorization in JetBrains Datalore Allows Unauthorized Access
CVE-2026-123286

5.9MEDIUM

Key Information:

Vendor

Jetbrains
Status
Datalore
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123286?

In JetBrains Datalore prior to version 2026.4, an improper authorization flaw was discovered that enables unauthorized users to access the notebook owner's file storage session token. This vulnerability could potentially allow attackers to exploit sensitive data and gain access to the owner's private files, highlighting the need for enhanced security measures in managing user access and permissions within Datalore.

Affected Version(s)

Datalore 0 < 2026.4

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.