EUVD-2026-90010
GHSA-f59m-626g-488f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Authenticated low-priv user (PR:L) over the network with no interaction; scope change (S:C) as spoofed mail impacts recipients, integrity-only (I:H), no confidentiality or availability loss.
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address
AnalysisAI
Authenticated users of JetBrains Hub can send arbitrary emails from the server's trusted address due to a missing authorization check in versions before 2026.2.52366. The flaw requires a valid low-privilege Hub account (PR:L) and network reachability to the instance, but no user interaction; it allows spoofing outbound email, which can damage trust in the organization's sender identity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated Hub account of any privilege level (PR:L) plus network reachability to the Hub instance; exploitation targets the email-sending feature whose authorization check is missing in versions before 2026.2.52366. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N = 7.7 High) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L) and no user interaction, with a scope change (S:C) and high integrity impact (I:H) but no confidentiality or availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 2026.2.52366; upgrade to this version or later, as this is the only complete fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all JetBrains Hub instances and identify any running versions before 2026.2.52366; restrict network access to only trusted users and enable monitoring of outbound email for unexpected sender activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Resource exhaustion DoS in @anephenix/hub (npm) before 0.2.16 allows any unauthenticated remote client to exhaust server
Privileged GITHUB_TOKEN exfiltration in the meltano/hub repository allows any unauthenticated attacker who can open a pu
Insecure permissions in Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows authenticated attackers with low-leve
Authentication bypass in JetBrains Hub (the identity and account-management server behind TeamCity, YouTrack, and other
Account takeover in JetBrains Hub is possible through predictable restore codes, affecting all versions prior to 2026.1.
Privilege escalation to superuser in JetBrains Hub before 2026.2.52442 allows an unauthenticated remote attacker to regi
Hub v2.0 property management system allows unauthenticated arbitrary file upload via /utils/uploadFile. Malicious PDF fi
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. Rated critical severity (CVSS 9.8), this vulne
In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed. Rated critical severity
In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset. Rated critical severity (CVSS
JetBrains Hub before 2025.3.119807 has an authentication bypass allowing administrative actions without proper credentia
JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). Rated critical severity (C
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today