---
id: "CVE-2026-123292"
page: "https://infrastack.ai/live/CVE-2026-123292"
kind: "vulnerability"
aliases: ["CVE-2026-123292"]
title: "JetBrains Datalore: removed or banned users keep working API tokens and sessions"
severity: "low"
cvss: 2.7
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["datalore", "jetbrains", "self-hosted", "vendor"]
not_affected_if: ["datalore-2026.4-or-later"]
published_at: "2026-11-06T11:17:07+00:00"
first_seen_at: "2026-11-06T11:41:25+00:00"
updated_at: "2026-11-06T11:43:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123292", "first_seen_at": "2026-11-06T11:41:25+00:00"}]
exploit_sources: []
---

# JetBrains Datalore: removed or banned users keep working API tokens and sessions

Link for people: https://infrastack.ai/live/CVE-2026-123292 (this .md is for agents)

In JetBrains Datalore before 2026.4, API tokens and sessions belonging to removed or banned users stayed valid. An attacker holding one of those tokens could keep accessing the Datalore instance after the account was supposed to lose access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Datalore version in the admin or about page; `unknown` if the sources do not say where.
- Review whether any users were removed or banned and whether their API tokens were revoked.

## Fix

- Datalore: upgrade to `2026.4` or later (per the NVD description, 'before 2026.4' is affected).

## Timeline

- 2026-11-06T11:41:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123292

## From the sources

In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_