CVE-2026-123292: Low severity vulnerability

Published Nov 6, 2026

Updated

In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade JetBrains Datalore to a version that resolves this vulnerability.
Fixed in 2026.4

Event History

Nov 6, 2026

CVE Published

via MITRE·10:27 AM

Data Sourced

via MITRE·10:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker would need a valid API token or session belonging to a user who has been removed or banned. The CVSS vector indicates high privileges are required.

What access could remain available through a removed or banned account?

The issue affects API tokens and sessions that remained valid after the associated user was removed or banned. The stated impact is limited to confidentiality, with no integrity or availability impact indicated.

Which Datalore versions are affected?

JetBrains Datalore versions before 2026.4 are affected. Upgrading to 2026.4 or later addresses the described token and session invalidation problem.

CVE-2026-123292: Low severity vulnerability

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access could remain available through a removed or banned account?

Which Datalore versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access could remain available through a removed or banned account?

Which Datalore versions are affected?