{"id":"CVE-2026-123289","kind":"vulnerability","aliases":["CVE-2026-123289"],"related":[],"title":"JetBrains Datalore: notebook viewers could modify files they should not","description":"In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files","summary":"JetBrains Datalore before 2026.4 has an authorisation flaw that let users with notebook view access modify files. An attacker with viewer access could change files in the workspace.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["datalore","jetbrains","notebooks","other"],"not_affected_if":["version-2026.4-or-later"],"how_to_check":"- Check the installed Datalore version against `2026.4`\n- Review who holds viewer access to shared notebooks","fix":"- Datalore: move to `2026.4` or later","status":"open","published_at":"2026-11-06T11:17:07+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","triaged_at":"2026-11-06T11:42:31+00:00","updated_at":"2026-11-06T11:42:31+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T11:42:31Z","model":"claude-haiku-5-5","output":{"fix":"- Datalore: move to `2026.4` or later","reach":"network","title":"JetBrains Datalore: notebook viewers could modify files they should not","impact":"medium","summary":"JetBrains Datalore before 2026.4 has an authorisation flaw that let users with notebook view access modify files. An attacker with viewer access could change files in the workspace.","audience":"businesses","category":"other","nicknames":[],"who_cares":["datalore","jetbrains","notebooks"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"notebook viewer modifies project files without edit permission","analyst_note":"","how_to_check":"- Check the installed Datalore version against `2026.4`\n- Review who holds viewer access to shared notebooks","plain_action":"","needs_analyst":false,"not_affected_if":["version-2026.4-or-later"],"who_is_affected":"Teams running JetBrains Datalore before 2026.4 where people are given viewer access to notebooks. Installations at 2026.4 or later are not affected by this flaw. Sources do not say whether hosted Datalore differs from self-managed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000633,"input_tokens":4160,"output_tokens":434,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123289':10A,13A '-2026':9A,12A '2026.4':20B,49C 'access':31B,38B 'allow':52C 'attack':35B 'authoris':23B,51C 'chang':40B 'could':5A,39B 'cve':8A,11A 'datalor':2A,14B,18B,47C 'file':7A,33B,41B,57C 'flaw':24B 'improp':50C 'jetbrain':1A,15B,17B,46C 'let':26B 'modifi':6A,32B,56C 'notebook':3A,16B,29B,53C 'user':27B 'view':30B 'viewer':4A,37B,54C 'workspac':44B","nicknames":[],"mitigations":[],"who_affected":"Teams running JetBrains Datalore before 2026.4 where people are given viewer access to notebooks. Installations at 2026.4 or later are not affected by this flaw. Sources do not say whether hosted Datalore differs from self-managed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["datalore","jetbrains","medium","notebooks","other"],"campaign_type":null,"search_a":"'-123289':10A,13A '-2026':9A,12A 'could':5A 'cve':8A,11A 'datalor':2A 'file':7A 'jetbrain':1A 'modifi':6A 'notebook':3A 'viewer':4A","search_b":"'2026.4':20B 'access':31B,38B 'attack':35B 'authoris':23B 'chang':40B 'could':39B 'datalor':14B,18B 'file':33B,41B 'flaw':24B 'jetbrain':15B,17B 'let':26B 'modifi':32B 'notebook':16B,29B 'user':27B 'view':30B 'viewer':37B 'workspac':44B","search_c":"'2026.4':49C 'allow':52C 'authoris':51C 'datalor':47C 'file':57C 'improp':50C 'jetbrain':46C 'modifi':56C 'notebook':53C 'viewer':54C","first_public_at":"2026-11-06T11:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123289","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123289","severity":null,"published_at":"2026-11-06T11:17:07+00:00","modified_at":"2026-11-06T11:17:07+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","fetched_at":"2026-11-06T11:41:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}