CVE-2026-123292 · Vendor
NO FIX YET · SEE WHAT TO DO
In JetBrains Datalore before 2026.4, API tokens and sessions belonging to removed or banned users stayed valid. An attacker holding one of those tokens could keep accessing the Datalore instance after the account was supposed to lose access.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host or run JetBrains Datalore where users are removed or banned and API tokens or sessions outlive them. unknown whether the hosted service is affected; the sources do not say.
Not affected if datalore-2026.4-or-later
Who cares datalore, jetbrains, self-hosted
unknown if the sources do not say where.2026.4 or later (per the NVD description, 'before 2026.4' is affected).In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.