---
id: "CVE-2026-123286"
page: "https://infrastack.ai/live/CVE-2026-123286"
kind: "vulnerability"
aliases: ["CVE-2026-123286"]
title: "JetBrains Datalore: improper authorisation exposes notebook owner's file storage session token"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["datalore", "jetbrains", "notebooks", "package"]
not_affected_if: ["version-2026.4-or-later"]
published_at: "2026-11-06T11:17:07+00:00"
first_seen_at: "2026-11-06T11:41:24+00:00"
updated_at: "2026-11-06T11:42:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123286", "first_seen_at": "2026-11-06T11:41:24+00:00"}]
exploit_sources: []
---

# JetBrains Datalore: improper authorisation exposes notebook owner's file storage session token

Link for people: https://infrastack.ai/live/CVE-2026-123286 (this .md is for agents)

JetBrains Datalore before 2026.4 has an improper authorisation flaw that lets an attacker read the session token for the notebook owner's file storage. With that token, the attacker could act against the owner's stored files.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Datalore version against the fixed release `2026.4`

## Fix

- Datalore: move to `2026.4` or later

## Timeline

- 2026-11-06T11:41:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123286

## From the sources

In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_