Description

In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-06T11:17:06.773Z",
  "pubdate": "2026-11-06T11:17:06.773Z",
  "executiveSummary": "An improper authorization vulnerability exists in JetBrains Datalore prior to version 2026.4, specifically regarding workspace management operations.\nThe flaw allows users with 'view-only' collaborative access to modify shared content within a workspace, an action that should be restricted to users with write or administrative privileges.\nThis vulnerability stems from a broken access control mechanism during workspace move operations, where the system fails to adequately validate the authorization level of the requesting participant.\nThe impact includes potential unauthorized data modification, tampering with collaborative project states, and an overall breach of the principle of least privilege within the Datalore environment.\nThe vulnerability is exploitable by authenticated users who have been granted legitimate view-only access to a specific workspace.\nExploitation does not require elevated privileges, as the system incorrectly elevates the implicit permission level during the specific function call to move a workspace or its contents.\nThe security risk is significant as it undermines the integrity of shared collaborative data and environments.\nOrganizations using JetBrains Datalore are advised to verify their current versioning and ensure that users are restricted appropriately based on assigned roles.",
  "technicalDetails": "The vulnerability is classified as an improper authorization flaw occurring during workspace management transitions. In JetBrains Datalore, workspaces can be subject to various organizational operations, including 'move' actions, which alter the hierarchy or location of collaborative assets.\nThe root cause of this vulnerability lies in an insufficient server-side authorization check within the workspace modification handler. When a request to move a workspace is received, the backend application fails to perform a comprehensive validation of the initiator's permissions against the target object's access control list (ACL).\nSpecifically, the application logic does not properly distinguish between 'owner/editor' roles and 'view-only' collaborators when processing the move request parameters. Instead of validating the user's write authorization before executing the move operation, the system processes the request based on the user's existing, albeit restricted, session context, erroneously permitting the modification action.\nThe attack flow proceeds as follows: First, a malicious actor with 'view-only' access identifies a workspace to which they have been granted access. Second, the user initiates a move request for that workspace. Third, because the backend logic incorrectly assumes that the workspace management operation is permitted regardless of the role, it processes the request and updates the content state accordingly. This effectively bypasses the intended Read-Only restriction.\nThe component affected is the Datalore authorization module responsible for handling workspace management operations. This vulnerability is applicable to all instances of Datalore preceding version 2026.4.\nThis is an authenticated vulnerability, meaning that an attacker must possess valid credentials and have been invited to a shared workspace as a view-only participant. No further elevation of privilege is required to trigger the failure, as the backend software itself grants the necessary permissions during the move request execution.\nThe post-exploitation impact includes the potential to rearrange, reclassify, or corrupt shared data environments. Because the system trusts the move request inherently, an attacker can manipulate the structure of shared content, which could lead to data loss or unintended access shifts if the move operation interacts with different permission inheritance models within the workspace structure.\nThe vulnerability demonstrates a failure to consistently enforce role-based access control (RBAC) across administrative operations, specifically during object transition states."
}