JetBrains Datalore versions prior to 2026.4 fail to revoke API tokens and sessions when a user is removed or banned. The residual credentials remain valid, allowing anyone who obtains them to authenticate to the platform. This flaw can enable unauthorized users to access notebooks, data, and project resources, potentially exposing sensitive information or corrupting data. The weakness is a classic instance of improper revocation or deletion of credential material, classified as CWE‑1464.

Affected systems include JetBrains Datalore installations running any version before the 2026.4 release. The vulnerability impacts the credential management and session handling components of that product.

The low CVSS score and absence of EPSS data suggest that the exploit probability is modest. However, organizations that rely on strict access controls should consider the threat real enough to warrant immediate verification of token revocation procedures and review of older session data. The fact that the vulnerability is not listed in KEV means no known widespread exploitation has been reported, but the potential for internal misuse or unintended access remains. Therefore, an inventory of active tokens and a revocation policy are recommended to mitigate the risk.