CVE-2026-123287 in Datalore
Summary
by MITRE • 11/06/2026
In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in JetBrains Datalore prior to version 2026.4 represents a critical failure in access control mechanisms, specifically classified under CWE-285: Improper Authorization. This flaw allows authenticated users who have the ability to publish interactive reports or notebooks to inadvertently expose private notebook files to unauthorized parties. The core technical issue lies in the misconfiguration of resource permissions during the publication process. When a user generates an interactive report from their data science work, the system fails to properly segregate the access controls for the underlying source code and raw data files versus the rendered output view. Consequently, while the public-facing interface may restrict direct viewing of private notebooks, the backend API endpoints responsible for serving static assets or downloadable components do not enforce strict authentication checks on these specific resources. This architectural oversight creates a side-channel through which sensitive information can be exfiltrated without requiring valid credentials from the requesting party.
From an operational perspective, this vulnerability poses significant risks to data privacy and intellectual property protection within organizations utilizing JetBrains Datalore for collaborative analytics. Private notebooks often contain proprietary algorithms, unpublicized research findings, or sensitive customer data processed during analysis. The ability to download these files without authentication means that any individual with the URL of a published report could potentially retrieve the original source material if they possess knowledge of the internal file structure or exploit specific endpoint behaviors. This undermines the fundamental trust model of cloud-based development environments where users expect their private workspace contents to remain isolated from public-facing outputs unless explicitly shared through proper sharing mechanisms. The impact is particularly severe in regulated industries such as finance, healthcare, and government sectors, where compliance with data protection standards like GDPR or HIPAA requires strict access logging and authorization enforcement for all sensitive datasets.
This type of vulnerability aligns closely with the MITRE ATT&CK technique T1530: Data from Cloud Storage Object, which describes adversaries accessing cloud storage objects that are not properly secured. In this context, although the initial vector is a published report rather than a direct object store link, the mechanism of exploitation relies on the same principle of misconfigured permissions leading to unauthorized data retrieval. The attacker does not need to compromise user credentials or exploit complex injection flaws; instead, they leverage the application's own functionality for sharing work products as a delivery method for sensitive assets. This highlights a common challenge in modern web applications where convenience features like public publishing are implemented without sufficient consideration for the security implications of linked resources.
To mitigate this vulnerability and prevent similar issues in future releases, JetBrains must implement rigorous access control checks on all API endpoints that serve notebook-related files, regardless of whether they are accessed via direct links or embedded within published reports. This involves ensuring that every request to retrieve private data assets is validated against the user's current session permissions and ownership status before any content is served. Additionally, implementing strict Content Security Policy headers and preventing hotlinking of sensitive resources can add an extra layer of defense. For users currently affected by this issue in older versions, it is imperative to upgrade immediately to version 2026.4 or later where these authorization checks have been corrected. Organizations should also review their sharing practices, ensuring that only necessary data is included in public reports and avoiding the publication of notebooks containing highly sensitive information unless absolutely required for collaboration with trusted partners under secure conditions.