---
id: "CVE-2026-123289"
page: "https://infrastack.ai/live/CVE-2026-123289"
kind: "vulnerability"
aliases: ["CVE-2026-123289"]
title: "JetBrains Datalore: notebook viewers could modify files they should not"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["datalore", "jetbrains", "notebooks", "other"]
not_affected_if: ["version-2026.4-or-later"]
published_at: "2026-11-06T11:17:07+00:00"
first_seen_at: "2026-11-06T11:41:24+00:00"
updated_at: "2026-11-06T11:42:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123289", "first_seen_at": "2026-11-06T11:41:24+00:00"}]
exploit_sources: []
---

# JetBrains Datalore: notebook viewers could modify files they should not

Link for people: https://infrastack.ai/live/CVE-2026-123289 (this .md is for agents)

JetBrains Datalore before 2026.4 has an authorisation flaw that let users with notebook view access modify files. An attacker with viewer access could change files in the workspace.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Datalore version against `2026.4`
- Review who holds viewer access to shared notebooks

## Fix

- Datalore: move to `2026.4` or later

## Timeline

- 2026-11-06T11:41:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123289

## From the sources

In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_