CVE-2026-123292 in Datalore
Summary
by MITRE • 11/06/2026
In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in JetBrains Datalore prior to version 2026.4 represents a critical authentication state management flaw that allows for the persistence of active credentials belonging to terminated user accounts. This issue stems from an insufficient invalidation mechanism within the application's session and token lifecycle management system. When an administrator removes or bans a specific user account, the backend processes correctly update the user status in the persistent identity store but fail to propagate this state change to the active authentication layer. Consequently, any API tokens generated by that user prior to the ban action remain valid, and existing browser sessions do not receive immediate termination signals from the server side. This creates a significant window of opportunity where previously authorized access remains functional despite the explicit revocation of privileges at the administrative level.
From a technical perspective, this flaw aligns with CWE-613, which describes insufficient session expiration, as well as CWE-284 regarding improper access control. The core issue lies in the lack of real-time synchronization between the user management module and the authentication middleware. In secure architectures, when an account is disabled or deleted, a global event should trigger the invalidation of all associated refresh tokens and API keys stored in distributed caches such as Redis or Memcached. Without this mechanism, the application continues to accept requests authenticated by these stale credentials because it relies on local session validity checks rather than querying a centralized revocation list for every incoming request. This design oversight means that the system trusts the static state of the token rather than its current authorization context relative to the user's account status.
The operational impact of this vulnerability is severe, particularly in enterprise environments where data sensitivity and compliance are paramount. An attacker who has obtained API tokens or session cookies from a banned employee could continue to access sensitive code repositories, execute notebooks containing proprietary algorithms, or exfiltrate confidential datasets long after their employment has ended or their account has been suspended due to policy violations. This persistence of access undermines the principle of least privilege and complicates incident response procedures during security breaches. If an attacker compromises a user's credentials before they are banned, this flaw ensures that those credentials remain viable for further exploitation even after detection and initial containment efforts have targeted the specific user account.
To mitigate this risk, JetBrains released version 2026.4 which addresses these session management deficiencies by implementing immediate token revocation upon account termination. For organizations still running older versions, it is imperative to manually rotate all API tokens associated with affected users immediately following any ban or removal action. Additionally, administrators should enforce shorter expiration times for refresh tokens and implement server-side session invalidation checks that query the user's current status on every authenticated request rather than relying solely on token validity periods. Integrating a centralized identity provider that supports real-time revocation lists can further harden the authentication flow against such state synchronization failures.
This vulnerability also relates to MITRE ATT&CK technique T1078, specifically Valid Accounts, as it allows an adversary to maintain persistence using legitimate credentials that should have been deactivated. The failure to invalidate sessions upon account disablement is a common pattern in legacy systems and highlights the importance of designing authentication services with explicit revocation capabilities. Security teams must ensure that their identity management workflows include automated steps for credential rotation and session termination as part of any user lifecycle change process. Regular audits of active tokens against current employee status can help identify lingering access points before they are exploited by malicious actors seeking to maintain unauthorized footholds within the environment.