{"id":"CVE-2026-123292","kind":"vulnerability","aliases":["CVE-2026-123292"],"related":[],"title":"JetBrains Datalore: removed or banned users keep working API tokens and sessions","description":"In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid","summary":"In JetBrains Datalore before 2026.4, API tokens and sessions belonging to removed or banned users stayed valid. An attacker holding one of those tokens could keep accessing the Datalore instance after the account was supposed to lose access.","severity":"low","cvss":2.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["datalore","jetbrains","self-hosted","vendor"],"not_affected_if":["datalore-2026.4-or-later"],"how_to_check":"- Check the Datalore version in the admin or about page; `unknown` if the sources do not say where.\n- Review whether any users were removed or banned and whether their API tokens were revoked.","fix":"- Datalore: upgrade to `2026.4` or later (per the NVD description, 'before 2026.4' is affected).","status":"open","published_at":"2026-11-06T11:17:07+00:00","first_seen_at":"2026-11-06T11:41:25+00:00","triaged_at":"2026-11-06T11:43:56+00:00","updated_at":"2026-11-06T11:43:56+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-06T11:43:56Z","model":"claude-haiku-5-5","output":{"fix":"- Datalore: upgrade to `2026.4` or later (per the NVD description, 'before 2026.4' is affected).","reach":"network","title":"JetBrains Datalore: removed or banned users keep working API tokens and sessions","impact":"medium","summary":"In JetBrains Datalore before 2026.4, API tokens and sessions belonging to removed or banned users stayed valid. An attacker holding one of those tokens could keep accessing the Datalore instance after the account was supposed to lose access.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["jetbrains","datalore","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"former users keep access to Datalore data via valid tokens","analyst_note":"","how_to_check":"- Check the Datalore version in the admin or about page; `unknown` if the sources do not say where.\n- Review whether any users were removed or banned and whether their API tokens were revoked.","plain_action":"","needs_analyst":false,"not_affected_if":["datalore-2026.4-or-later"],"who_is_affected":"Teams that self-host or run JetBrains Datalore where users are removed or banned and API tokens or sessions outlive them. unknown whether the hosted service is affected; the sources do not say.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000663,"input_tokens":4163,"output_tokens":493,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-123292':15A,18A '-2026':14A,17A '2026.4':29B,67C 'access':51B,62B 'account':57B 'api':9A,30B,68C 'attack':43B 'ban':5A,38B,75C 'belong':34B 'could':49B 'cve':13A,16A 'datalor':2A,19B,27B,53B,65C 'hold':44B 'host':23B 'instanc':54B 'jetbrain':1A,20B,26B,64C 'keep':7A,50B 'lose':61B 'one':45B 'remain':77C 'remov':3A,36B,73C 'self':22B 'self-host':21B 'session':12A,33B,71C 'stay':40B 'suppos':59B 'token':10A,31B,48B,69C 'user':6A,39B,76C 'valid':41B,78C 'vendor':24B 'work':8A","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host or run JetBrains Datalore where users are removed or banned and API tokens or sessions outlive them. unknown whether the hosted service is affected; the sources do not say.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["datalore","jetbrains","low","selfhosted","vendor"],"campaign_type":null,"search_a":"'-123292':15A,18A '-2026':14A,17A 'api':9A 'ban':5A 'cve':13A,16A 'datalor':2A 'jetbrain':1A 'keep':7A 'remov':3A 'session':12A 'token':10A 'user':6A 'work':8A","search_b":"'2026.4':29B 'access':51B,62B 'account':57B 'api':30B 'attack':43B 'ban':38B 'belong':34B 'could':49B 'datalor':19B,27B,53B 'hold':44B 'host':23B 'instanc':54B 'jetbrain':20B,26B 'keep':50B 'lose':61B 'one':45B 'remov':36B 'self':22B 'self-host':21B 'session':33B 'stay':40B 'suppos':59B 'token':31B,48B 'user':39B 'valid':41B 'vendor':24B","search_c":"'2026.4':67C 'api':68C 'ban':75C 'datalor':65C 'jetbrain':64C 'remain':77C 'remov':73C 'session':71C 'token':69C 'user':76C 'valid':78C","first_public_at":"2026-11-06T11:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123292","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123292","severity":null,"published_at":"2026-11-06T11:17:07+00:00","modified_at":"2026-11-06T11:17:07+00:00","first_seen_at":"2026-11-06T11:41:25+00:00","fetched_at":"2026-11-06T11:41:25+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}