In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modi…

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• jetbrains.com/privacy-security/issues-fixed Diğer

Kayıt geçmişi

1. 6 Kas 2026 13:27Yayımlandı

İlgili açıklar

• 2,7 CVE-2026-123292In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid
• 5,3 CVE-2026-123290In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interact…
• 4,3 CVE-2026-123291In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs not…
• 5,4 CVE-2026-123289In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
• 5,4 CVE-2026-123288In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link
• 5,9 CVE-2026-123286In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token