The vulnerability stems from an improper validation of workspace ownership. When a user accesses the platform, the system fails to verify that the requester is the legitimate owner of a workspace before returning its issues and notebook runs. This oversight can let an attacker read sensitive data from another workspace, exposing informational content such as problem statements, run logs, and notebook outputs. The weakness corresponds to CWE‑639, which denotes unauthorized access to data due to flawed access control.

JetBrains Datalore installations running any version prior to 2026.4 are impacted. The affected product is the Datalore web-based data science platform provided by JetBrains. No specific sub‑versions are listed, so any build older than 2026.4 is considered vulnerable.

The CVSS score for this issue is 4.3, indicating a moderate impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited or no known exploitation in the wild. Attackers would likely leverage the web interface or API to trigger a request that retrieves another user’s workspace data, presuming they have valid credentials to authenticate to Datalore. Because the flaw is an access‑control check, it does not require additional privileges beyond an authenticated account, making the attack vector feasible for any user who can impersonate or otherwise gain access to the platform.