CVE-2026-123282

HighCVSS 7.4/10Last modified Nov 10, 2026

Description

In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-672

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 6, 2026
Last modified
Nov 10, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-1232836.8In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered accountCVE-2026-1232846.5In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared contentCVE-2026-1232858.8In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injectionCVE-2026-1232866.5In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session tokenCVE-2026-1232877.5In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reportsCVE-2026-1232885.4In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor linkCVE-2026-1232894.3In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify filesCVE-2026-123295.3Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12.CVE-2026-1232905.3In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpCVE-2026-1232914.3In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebookCVE-2026-1232922.7In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained validCVE-2026-1232937.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting
CVE-2026-123282: High severity, CVSS 7.4 | Vulnix