EUVD-2026-90006
GHSA-q872-prmj-w466
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with read-only project access
-
ExploitSend crafted template-modification request
-
ExecutionOverwrite project notification templates
-
ImpactInject malicious or misleading notification content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated YouTrack account that already holds read-only access to the target project; the flaw lets that account perform an action - overwriting the project's notification templates - that should be restricted to higher project privileges. Limiting factors: the attacker must be a provisioned user with project visibility (PR:L, not anonymous/unauthenticated), the impact is scoped to a single project's notification templates (S:U, no availability or broad confidentiality impact), and only versions before 2026.2.18991 are affected. No user interaction is required (UI:N), and no special non-default configuration is called out in the description. |
| Impact | This is a moderate, authenticated-authorization flaw (CWE-863) rather than a high-urgency crisis. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N = 7.1) indicates a network-reachable, low-complexity attack but one that explicitly requires authenticated low privileges (PR:L) - specifically an existing user who already holds at least read-only access to the target project. All exploitation signals point to low real-world urgency: EPSS is 0.31% (22nd percentile), there is no CISA KEV listing, and no public exploit was reported. CISA's SSVC framework reinforces this - Exploitation: none, Automatable: no, Technical Impact: partial - so this does not meet criteria for accelerated remediation. The signals are internally consistent (low EPSS, no KEV, no POC, SSVC 'none'), with no conflicts to flag. The main caveat is that the vendor-assigned C:L seems generous for a flaw described purely as template overwriting (an integrity action); the realistic impact is weighted toward integrity, not confidentiality. Overall: a legitimate issue worth patching on a normal cycle, driven by insider/low-privilege misuse potential rather than mass exploitation risk. |
| Exploit ScenarioDerived | A user granted only read-only access to a YouTrack project (for example an external contractor or a low-trust internal account) issues an API or UI request to modify that project's notification templates - an action that should require elevated project privileges. No public exploit code was identified, but the low attack complexity and authenticated-but-low privilege requirement make abuse by an existing low-privileged user straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 02, 2026
Incorrect authorization in JetBrains YouTrack before 2026.2.18991 lets a user who holds only read-only access to a project overwrite that project's notification templates, an action that should require higher project privileges. The attack is network-reachable and needs no user interaction, but it does require an authenticated account (CVSS PR:L) that already has visibility into the target project, and the effect is scoped to a single project's notification configuration. Severity is moderate (vendor score 7.1; independently assessed impact limited to integrity, with no confidentiality or availability effect), EPSS is low at 0.31% (22nd percentile), CISA SSVC rates exploitation as none and non-automatable, and no public exploit code has been identified at time of analysis. JetBrains has released a fix.
Earlier versions of this analysis (1)
Authenticated users with only read-only access to a JetBrains YouTrack project can overwrite project notification templates due to a missing authorization check in versions before 2026.2.18991. This network-reachable flaw has low complexity and requires no victim interaction, allowing an attacker with valid credentials and minimal project membership to tamper with notification content sent to project members. No public exploit code has been identified, but the low privilege requirement makes it a significant risk in shared or multi-tenant instances, and the CVSS vector (PR:L) confirms exploitation requires authentication.
RemediationAI
Vendor-released patch: upgrade JetBrains YouTrack to 2026.2.18991 or later, which contains the corrected authorization check on the project notification-template write path; JetBrains Cloud instances are typically remediated automatically by the vendor, while self-hosted deployments must upgrade manually. Track the fix through JetBrains' fixed-issues advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ and confirm the running build number after upgrading. If upgrading immediately is not possible, the practical compensating control is to audit and tighten project membership so that only trusted, fully-vetted accounts hold any level of access - including read-only roles - to sensitive projects, because the flaw is only reachable by an already-provisioned user with project visibility; the trade-off is reduced collaboration and additional administrative overhead, and it does not remove the underlying defect. In parallel, review existing project notification templates for unexpected modification and consider monitoring or alerting on template-change events until the upgrade lands, accepting that this is detective rather than preventive. There is no configuration toggle that disables the vulnerable code path, so upgrade remains the definitive fix; note that no vendor-released workaround short of patching is documented.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is an incorrect authorization check, classified as CWE-863 (Incorrect Authorization). YouTrack's project notification templates define the message content used when the system notifies users about project events; modifying them is a privileged administrative action within a project. In affected builds the server-side authorization gate on the template-write path failed to verify that the requesting user held the required project-level permission, so any authenticated principal with read-only project access could reach and mutate that state. Because the request is a normal HTTP request handled over the network (AV:N) and no interaction from another user is needed (UI:N), the only real barrier is having a provisioned account with project visibility (PR:L per the assessed vector) - this is not an anonymous or unauthenticated bypass despite the 'Authentication Bypass' tag on the record. The scope is unchanged (S:U) since the flaw does not chain into the wider YouTrack instance, and the assessed impact is integrity-only (I:H, C:N, A:N), reflecting that tampering with notification templates can alter or misdirect project communications rather than expose data or cause downtime. Only versions prior to 2026.2.18991 are affected, consistent with the EUVD version range of 0 through 2026.2.18991 and the CPE wildcard cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*.
Know when Youtrack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Requires an authenticated read-only project user so PR:L; network web app AV:N/AC:L; impact is template overwrite so I:H, with no real confidentiality (C:N) or availability (A:N) loss.
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates
Executive ViewAI
JetBrains YouTrack installations running versions prior to 2026.2.18991 allow any user with read-only project access to modify that project's notification templates, a configuration change that should require elevated project privileges. The exposure affects a broad population - anyone with visibility into a project - and undermines the integrity of the alerting workflows teams depend on to detect security and delivery issues. Because the flaw requires an authenticated account and is confined to a single project's notification settings, the operational risk is contained but still warrants prompt remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an auth
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notifi
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Exploit-DB