{"id":"CVE-2026-123287","kind":"vulnerability","aliases":["CVE-2026-123287"],"related":[],"title":"JetBrains Datalore: private notebook files downloadable without authentication","description":"In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports","summary":"In JetBrains Datalore before 2026.4, private notebook files could be downloaded by anyone through published interactive reports. An attacker with no account can read notebook contents that were meant to stay private.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["datalore","jetbrains","other","self-hosted"],"not_affected_if":["no-published-reports","version-2026.4-or-later"],"how_to_check":"- Check the installed Datalore version against the fixed version stated in the advisory, `2026.4`.\n- Check whether any interactive reports are published from Datalore notebooks, since the flaw runs through published reports.","fix":"- Move Datalore to `2026.4` or later.","status":"open","published_at":"2026-11-06T11:17:07+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","triaged_at":"2026-11-06T11:42:23+00:00","updated_at":"2026-11-06T11:42:23+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T11:42:23Z","model":"claude-haiku-5-5","output":{"fix":"- Move Datalore to `2026.4` or later.","reach":"internet","title":"JetBrains Datalore: private notebook files downloadable without authentication","impact":"medium","summary":"In JetBrains Datalore before 2026.4, private notebook files could be downloaded by anyone through published interactive reports. An attacker with no account can read notebook contents that were meant to stay private.","audience":"businesses","category":"other","nicknames":[],"who_cares":["datalore","jetbrains","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated readers download private notebook files","analyst_note":"Confirm the exact affected publishing feature and whether it is enabled by default; the NVD entry gives only the description.","how_to_check":"- Check the installed Datalore version against the fixed version stated in the advisory, `2026.4`.\n- Check whether any interactive reports are published from Datalore notebooks, since the flaw runs through published reports.","plain_action":"","needs_analyst":true,"not_affected_if":["version-2026.4-or-later","no-published-reports"],"who_is_affected":"Teams that run self-hosted or on-premises Datalore before 2026.4 and publish interactive reports are exposed. Installations that publish no reports, or that run a newer release, are not affected by this description. The sources do not give further detail on configuration.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":4162,"output_tokens":516,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123287':11A,14A '-2026':10A,13A '2026.4':25B,57C 'account':42B 'anyon':33B 'attack':39B 'authent':8A,65C 'content':46B 'could':29B,61C 'cve':9A,12A 'datalor':2A,15B,23B,55C 'download':6A,31B,63C 'file':5A,28B,60C 'host':20B 'interact':36B,68C 'jetbrain':1A,16B,22B,54C 'meant':49B 'notebook':4A,27B,45B,59C 'privat':3A,26B,52B,58C 'publish':35B,67C 'read':44B 'report':37B,69C 'self':19B 'self-host':18B 'stay':51B 'via':66C 'without':7A,64C","nicknames":[],"mitigations":[],"who_affected":"Teams that run self-hosted or on-premises Datalore before 2026.4 and publish interactive reports are exposed. Installations that publish no reports, or that run a newer release, are not affected by this description. The sources do not give further detail on configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["datalore","jetbrains","medium","other","selfhosted"],"campaign_type":null,"search_a":"'-123287':11A,14A '-2026':10A,13A 'authent':8A 'cve':9A,12A 'datalor':2A 'download':6A 'file':5A 'jetbrain':1A 'notebook':4A 'privat':3A 'without':7A","search_b":"'2026.4':25B 'account':42B 'anyon':33B 'attack':39B 'content':46B 'could':29B 'datalor':15B,23B 'download':31B 'file':28B 'host':20B 'interact':36B 'jetbrain':16B,22B 'meant':49B 'notebook':27B,45B 'privat':26B,52B 'publish':35B 'read':44B 'report':37B 'self':19B 'self-host':18B 'stay':51B","search_c":"'2026.4':57C 'authent':65C 'could':61C 'datalor':55C 'download':63C 'file':60C 'interact':68C 'jetbrain':54C 'notebook':59C 'privat':58C 'publish':67C 'report':69C 'via':66C 'without':64C","first_public_at":"2026-11-06T11:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123287","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123287","severity":null,"published_at":"2026-11-06T11:17:07+00:00","modified_at":"2026-11-06T11:17:07+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","fetched_at":"2026-11-06T11:41:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}