Incorrect authorization in jupyterhub - #VU162715
Published: November 9, 2026
Vulnerability identifier: #VU162715
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an administrator to cause sharing permissions to be applied to an unintended user.
The vulnerability exists due to JupyterHub sharing scopes not following user renames in deployments with user-initiated sharing enabled, which is disabled by default. An administrator can rename a user while a share is granted and create another user with the original name, causing the new account to receive unintended sharing permissions.
Affected software
jupyterhub
Remediation
Install security update from vendor's website.
jupyterhub - update to 5.5.2