CVE-2026-123277

MediumCVSS 5.0/10Last modified Nov 6, 2026

Description

In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 6, 2026
Last modified
Nov 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1232786.7In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpointCVE-2026-1232799.0In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaboratorsCVE-2026-123288.1Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of theseCVE-2026-1232808.1In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reportsCVE-2026-1232817.5In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount brokerCVE-2026-1232827.4In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated sessionCVE-2026-1232836.8In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered accountCVE-2026-1232846.5In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared contentCVE-2026-1232858.8In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injectionCVE-2026-1232866.5In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session tokenCVE-2026-1232877.5In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reportsCVE-2026-1232885.4In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link
CVE-2026-123277: Medium severity, CVSS 5.0 | Vulnix