Description

In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-11-06T11:17:07.887Z",
  "pubdate": "2026-11-06T11:17:07.887Z",
  "executiveSummary": "This vulnerability involves an improper session and token invalidation mechanism in JetBrains Datalore. The flaw permits API tokens and user sessions to remain active even after the associated user account has been explicitly removed or banned from the system. This oversight constitutes a critical security failure in access control management, effectively granting unauthorized or terminated entities persistent access to the application environment. The vulnerability impacts all versions of JetBrains Datalore prior to 2026.4. The risk implications are severe, as it allows potentially malicious actors or former personnel whose access should have been revoked to maintain long-term authentication state. An attacker does not require further authentication once they possess a session token or API key that was generated prior to account deletion. This bypasses organizational offboarding procedures and security protocols, potentially leading to unauthorized data exfiltration, workspace manipulation, or further exploitation of the Datalore infrastructure. The lack of an automated, mandatory invalidation trigger upon account status change represents a significant breakdown in identity and access management (IAM) enforcement.",
  "technicalDetails": "The vulnerability resides within the authentication and authorization subsystem of JetBrains Datalore. The root cause is a failure of the session management lifecycle to synchronize the state of user authentication tokens with the persistent storage of user account status. When a user is flagged as 'removed' or 'banned' in the central user directory or database, the application’s session validator fails to cross-reference the account's active status during the authentication handshake process.\nUnder normal operating conditions, a session token or API key should be ephemeral and bound to the cryptographic state of an active user record. In the vulnerable versions (pre-2026.4), the authentication middleware prioritizes the validity of the token signature over the current operational state of the user account. Consequently, the server-side validator confirms the structural integrity of the token without verifying if the underlying user record exists or remains in good standing.\nThe attack flow proceeds as follows: 1) An attacker or a departing user obtains a valid API token or active browser session token before their account is banned or deleted. 2) The administrator performs the account removal or ban. 3) Because the backend session management service does not explicitly invalidate or blacklist session identifiers associated with the affected UID upon deletion, the existing token remains functionally valid. 4) The attacker presents the token in subsequent API requests or web sessions. 5) The Datalore backend validates the token signature successfully. 6) Access is granted to the workspace or API endpoints, despite the account no longer existing in the active user database.\nThis behavior allows for indefinite post-account-termination access. Since the application fails to perform a lookup to verify the 'active' status of the user profile upon each authenticated request, the session effectively becomes a static backdoor. The impact is significant, as it permits persistent unauthorized access to notebooks, datasets, and API-exposed resources. The exploitation requires no specialized tools; it simply leverages valid, pre-existing credentials that the system failed to purge or invalidate during the standard offboarding workflow. This represents a failure in the synchronization between identity management systems and session state validation logic, leaving the platform exposed to access from accounts that have been formally revoked by system administrators."
}