{"id":"CVE-2026-123286","kind":"vulnerability","aliases":["CVE-2026-123286"],"related":[],"title":"JetBrains Datalore: improper authorisation exposes notebook owner's file storage session token","description":"In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token","summary":"JetBrains Datalore before 2026.4 has an improper authorisation flaw that lets an attacker read the session token for the notebook owner's file storage. With that token, the attacker could act against the owner's stored files.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["datalore","jetbrains","notebooks","package"],"not_affected_if":["version-2026.4-or-later"],"how_to_check":"- Check the installed Datalore version against the fixed release `2026.4`","fix":"- Datalore: move to `2026.4` or later","status":"open","published_at":"2026-11-06T11:17:07+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","triaged_at":"2026-11-06T11:42:24+00:00","updated_at":"2026-11-06T11:42:24+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-06T11:42:24Z","model":"claude-haiku-5-5","output":{"fix":"- Datalore: move to `2026.4` or later","reach":"unknown","title":"JetBrains Datalore: improper authorisation exposes notebook owner's file storage session token","impact":"medium","summary":"JetBrains Datalore before 2026.4 has an improper authorisation flaw that lets an attacker read the session token for the notebook owner's file storage. With that token, the attacker could act against the owner's stored files.","audience":"businesses","category":"package","nicknames":[],"who_cares":["datalore","jetbrains","notebooks"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads a notebook owner's file storage session token","analyst_note":"Confirm attack preconditions and whether the Datalore vendor advisory names the exact fixed build; source is NVD only.","how_to_check":"- Check the installed Datalore version against the fixed release `2026.4`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["version-2026.4-or-later"],"who_is_affected":"Teams running a Datalore instance before 2026.4 where notebooks use file storage. The sources do not say which deployment modes are affected, so unknown beyond the version range.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000651,"input_tokens":4166,"output_tokens":469,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123286':15A,18A '-2026':14A,17A '2026.4':26B,64C 'act':53B 'allow':67C 'attack':35B,51B 'authoris':4A,30B,66C 'could':52B 'cve':13A,16A 'datalor':2A,19B,24B,62C 'expos':5A 'file':9A,45B,59B,73C 'flaw':31B 'improp':3A,29B,65C 'jetbrain':1A,20B,23B,61C 'let':33B 'notebook':6A,21B,42B,70C 'owner':7A,43B,56B,71C 'packag':22B 'read':36B,68C 'session':11A,38B,75C 'storag':10A,46B,74C 'store':58B 'token':12A,39B,49B,76C","nicknames":[],"mitigations":[],"who_affected":"Teams running a Datalore instance before 2026.4 where notebooks use file storage. The sources do not say which deployment modes are affected, so unknown beyond the version range.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["datalore","jetbrains","medium","notebooks","package"],"campaign_type":null,"search_a":"'-123286':15A,18A '-2026':14A,17A 'authoris':4A 'cve':13A,16A 'datalor':2A 'expos':5A 'file':9A 'improp':3A 'jetbrain':1A 'notebook':6A 'owner':7A 'session':11A 'storag':10A 'token':12A","search_b":"'2026.4':26B 'act':53B 'attack':35B,51B 'authoris':30B 'could':52B 'datalor':19B,24B 'file':45B,59B 'flaw':31B 'improp':29B 'jetbrain':20B,23B 'let':33B 'notebook':21B,42B 'owner':43B,56B 'packag':22B 'read':36B 'session':38B 'storag':46B 'store':58B 'token':39B,49B","search_c":"'2026.4':64C 'allow':67C 'authoris':66C 'datalor':62C 'file':73C 'improp':65C 'jetbrain':61C 'notebook':70C 'owner':71C 'read':68C 'session':75C 'storag':74C 'token':76C","first_public_at":"2026-11-06T11:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123286","severity":null,"published_at":"2026-11-06T11:17:07+00:00","modified_at":"2026-11-06T11:17:07+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","fetched_at":"2026-11-06T11:41:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}