In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files
CWE-863