{"id":"CVE-2026-123291","kind":"vulnerability","aliases":["CVE-2026-123291"],"related":[],"title":"JetBrains Datalore: flaw lets users read other workspaces' issues and runs","description":"In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook","summary":"Before version 2026.4, JetBrains Datalore did not validate workspace ownership, so one user could read another workspace's issues and notebook runs. The attacker gets read access to data belonging to other workspaces.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["datalore","jetbrains","self-hosted","vendor"],"not_affected_if":["version-2026.4-or-later"],"how_to_check":"- Check the installed Datalore version against the fixed version `2026.4`.","fix":"- JetBrains Datalore: upgrade to `2026.4` or later.","status":"open","published_at":"2026-11-06T11:17:07+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","triaged_at":"2026-11-06T11:42:41+00:00","updated_at":"2026-11-06T11:42:41+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-06T11:42:41Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains Datalore: upgrade to `2026.4` or later.","reach":"network","title":"JetBrains Datalore: flaw lets users read other workspaces' issues and runs","impact":"low","summary":"Before version 2026.4, JetBrains Datalore did not validate workspace ownership, so one user could read another workspace's issues and notebook runs. The attacker gets read access to data belonging to other workspaces.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["jetbrains","datalore","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Another workspace's issues and notebook runs readable by an account","analyst_note":"","how_to_check":"- Check the installed Datalore version against the fixed version `2026.4`.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2026.4-or-later"],"who_is_affected":"Teams that run JetBrains Datalore with multiple workspaces where users share the same instance. The sources do not describe further conditions, so single-workspace deployments are unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00064,"input_tokens":4168,"output_tokens":447,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123291':14A,17A '-2026':13A,16A '2026.4':26B,61C 'access':50B 'allow':65C 'anoth':39B,67C 'attack':47B 'belong':53B 'could':37B 'cve':12A,15A 'data':52B 'datalor':2A,18B,28B,59C 'flaw':3A 'get':48B 'host':22B 'improp':62C 'issu':9A,42B,70C 'jetbrain':1A,19B,27B,58C 'let':4A 'notebook':44B,73C 'one':35B 'owner':63C 'ownership':33B 'read':6A,38B,49B,66C 'run':11A,45B,72C 'self':21B 'self-host':20B 'user':5A,36B 'valid':31B,64C 'vendor':23B 'version':25B 'workspac':8A,32B,40B,56B,68C","nicknames":[],"mitigations":[],"who_affected":"Teams that run JetBrains Datalore with multiple workspaces where users share the same instance. The sources do not describe further conditions, so single-workspace deployments are unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["datalore","jetbrains","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-123291':14A,17A '-2026':13A,16A 'cve':12A,15A 'datalor':2A 'flaw':3A 'issu':9A 'jetbrain':1A 'let':4A 'read':6A 'run':11A 'user':5A 'workspac':8A","search_b":"'2026.4':26B 'access':50B 'anoth':39B 'attack':47B 'belong':53B 'could':37B 'data':52B 'datalor':18B,28B 'get':48B 'host':22B 'issu':42B 'jetbrain':19B,27B 'notebook':44B 'one':35B 'ownership':33B 'read':38B,49B 'run':45B 'self':21B 'self-host':20B 'user':36B 'valid':31B 'vendor':23B 'version':25B 'workspac':32B,40B,56B","search_c":"'2026.4':61C 'allow':65C 'anoth':67C 'datalor':59C 'improp':62C 'issu':70C 'jetbrain':58C 'notebook':73C 'owner':63C 'read':66C 'run':72C 'valid':64C 'workspac':68C","first_public_at":"2026-11-06T11:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123291","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123291","severity":null,"published_at":"2026-11-06T11:17:07+00:00","modified_at":"2026-11-06T11:17:07+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","fetched_at":"2026-11-06T11:41:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}