EUVD-2026-90013
GHSA-9gqg-vfjp-57cq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege YouTrack user
-
DeliveryTarget helpdesk project with Authorized Reporters restriction
-
ExploitBypass missing authorization check
-
ExecutionSubmit unauthorized helpdesk report
-
ImpactInject content into restricted queue
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a running YouTrack instance older than 2026.2.19197, (2) a helpdesk project that has been configured with an Authorized Reporters allowlist (the restriction being bypassed - so the feature must be in use), and (3) an authenticated account with at least low privileges (PR:L), i.e. not a fully anonymous attacker. Limiting factors: it only affects helpdesk projects that actively restrict reporters, the attacker must already be able to authenticate to the instance, and the impact is confined to integrity (unauthorized report submission) with no data disclosure or service disruption. Not exploitable against default configurations that do not use the Authorized Reporters restriction. |
| Impact | This is a genuine but low-severity authorization flaw, correctly rated CVSS 4.3. The vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) describes a network-reachable, low-complexity bug requiring some level of authentication (PR:L) with a limited integrity-only impact and no confidentiality or availability effect - consistent with CWE-862 Missing Authorization. No EPSS score, KEV listing, or POC is present in the input, so there is no signal of active or automated exploitation; per the available data this is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The signals are internally consistent (no CVSS-vs-description conflict), and the low impact ceiling (I:L only) means that even successful exploitation yields modest gain - bypassing an access-control list rather than compromising data or availability. Net: a real but low-priority issue that should be patched in routine maintenance, not treated as an emergency. Note the input tag 'Authentication Bypass' is somewhat misleading - this is an authorization/access-control bypass (CWE-862), not authentication bypass. |
| Exploit ScenarioDerived | An authenticated low-privilege YouTrack user who is NOT on a helpdesk project's Authorized Reporters allowlist crafts a request to submit or create a helpdesk report anyway, bypassing the reporter restriction the project owner configured. This lets them inject unauthorized tickets/content into a restricted helpdesk queue (integrity impact). No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Authorization bypass in JetBrains YouTrack before 2026.2.19197 lets an authenticated low-privileged user circumvent a helpdesk project's Authorized Reporters allowlist and file reports that the configuration was meant to block. The issue is network-reachable with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3), but its impact is limited to integrity - unauthorized report submission - with no confidentiality or availability effect. It applies only to instances where a helpdesk project has actually been configured with an Authorized Reporters restriction, and the CVSS PR:L metric confirms the attacker must already hold a valid low-privileged account rather than being fully anonymous; no public exploit identified at time of analysis.
RemediationAI
Upgrade JetBrains YouTrack to 2026.2.19197 or a later release, which is the vendor-released fixed version and the authoritative remediation; consult the JetBrains fixed-issues advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ for confirmation of the build number before scheduling the maintenance window. If immediate upgrade is not possible, inspect every helpdesk project that depends on an Authorized Reporters allowlist and consider temporarily switching those projects to a configuration that does not rely on the bypassable allowlist as the sole gate - for example, tightening project-level access so that only trusted accounts can reach the project at all - accepting that this broadens the restriction beyond individual reporters and may block legitimate submitters. As a detective compensating control, review audit logs and incoming reports for submissions originating from accounts that are not on the Authorized Reporters list, and constrain who may hold even low-privileged accounts on the instance, since PR:L means an authenticated foothold is a prerequisite rather than a full anonymous attack; note that log review only detects abuse after the fact and does not prevent unauthorized submissions. No vendor-reported workaround exists beyond the version upgrade and these configuration-side mitigations, and there is no indication that a patch-less deployment is safe without one of them.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is CWE-862 (Missing Authorization): a server-side route or action in YouTrack's helpdesk project workflow fails to enforce the project's Authorized Reporters allowlist before accepting a report submission, so the presence of that list is never validated as a gate. Authorization-restriction features of this kind are commonly implemented as a check in the UI layer or one entry point while a parallel API/endpoint path skips it, which matches the description of the list being 'bypassed.' Because the CVSS vector carries PR:L and the scope is unchanged (S:U), the bypass operates within the privileges the attacker already holds and does not escalate to administrative access; the only measurable effect is a low-integrity impact from creating report content attributed to a non-authorized reporter. The affected footprint in the CPE data is the entire JetBrains YouTrack product line (cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*), bounded by version rather than edition, with ENISA EUVD entry EUVD-2026-90013 tracking the same 0 < 2026.2.19197 range.
Know when Youtrack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable and low-complexity; PR:L because an authenticated account is needed; integrity-only (I:L) unauthorized report submission with no confidentiality or availability impact.
Primary rating from Vendor (JetBrains).
CVSS VectorVendor: JetBrains
Lifecycle Timeline
1DescriptionCVE.org
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an auth
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notifi
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Exploit-DB