Id Server EUVD-2026-11772

Authenticated user account required. Vulnerability only impacts configurations with horizontal privilege escalation vectors enabled. Attacker must have valid login credentials to trigger the broken access control flaw.

Despite the high CVSS 8.8 score, the real-world risk is moderated by several factors. The attack requires authentication (PR:L) and is only viable in specific configurations, limiting the attack surface. The EPSS score of 0.36942 indicates a 36.9% probability of exploitation in the next 30 days, which is notably high. However, the vulnerability is not listed in CISA's KEV catalog, suggesting no confirmed active exploitation. The attack complexity is low (AC:L) once prerequisites are met, and the impact is severe with high confidentiality and integrity impact on both the vulnerable and subsequent systems (VC:H/VI:H/SC:H/SI:H). This makes it a priority for organizations using affected Datalore configurations.

An attacker with legitimate low-privileged access to a Datalore instance could manipulate API requests or session parameters to access notebooks, datasets, or computational resources belonging to other users at the same privilege level. Given the low attack complexity and network-based attack vector, exploitation could be automated once an attacker understands the specific vulnerable configuration. No public proof-of-concept exists, but the straightforward nature of authorization bypass vulnerabilities suggests exploit development would not be technically challenging for a motivated attacker.