CVE Feed

    Dashboard / CVE / CVE-2026-123289

    CVE-2026-123289

    In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files

    Published:Nov 6, 2026
    Last Modified:Nov 6, 2026
    EPS:Nov 6, 2026
    EPSS Score:
    CVSS Score:5.4

    Affected Products

    Vendor
    Jetbrains
    Product
    Datalore

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-123836 (CVSS 8.8) — In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git b…
    CVE-2026-123835 (CVSS 5.9) — In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init scri…
    CVE-2026-123834 (CVSS 7.5) — In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspac…
    CVE-2026-123292 (CVSS 2.7) — In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid…
    CVE-2026-123291 (CVSS 4.3) — In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and r…
    CVE-2026-123290 (CVSS 5.3) — In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public i…
    CVE-2026-123288 (CVSS 5.4) — In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link…
    CVE-2026-123287 (CVSS 5.9) — In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via publ…
    CVE-2026-123286 (CVSS 5.9) — In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage sess…
    CVE-2026-123285 (CVSS 6.3) — In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM opti…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High