SB2026110970 - Incorrect authorization in jupyterhub

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110970

SB2026110970 - Incorrect authorization in jupyterhub

Published: November 9, 2026

Security Bulletin ID SB2026110970
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an administrator to cause sharing permissions to be applied to an unintended user.

The vulnerability exists due to JupyterHub sharing scopes not following user renames in deployments with user-initiated sharing enabled, which is disabled by default. An administrator can rename a user while a share is granted and create another user with the original name, causing the new account to receive unintended sharing permissions.


Remediation

Install update from vendor's website.

References