The vulnerability is an improper scope validation in JetBrains Datalore before version 2026.4 that allows an attacker to use another workspace's service account. This can enable unauthorized execution of database tasks with the privileges of the target workspace, potentially leading to data exfiltration or modification. The weakness aligns with CWE‑639, indicating insufficient authorization checks.

JetBrains Datalore is the affected product. All versions earlier than 2026.4 are impacted. The problem arises when database tasks are configured with a service account belonging to a different workspace.

The CVSS vector reveals a score of 7.5, indicating a high impact when successful. EPSS is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation would likely require an attacker with access to a workspace that can create or modify database tasks; if they can identify a service account from another workspace, they can divert that account's privileges. No public exploit is known, but a determined adversary could manually craft a task to gain cross-workspace access.