CVE-2026-28193
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint
Analysis
Authenticated users in JetBrains YouTrack versions prior to 2025.3.121962 can bypass authorization controls to access the app permissions endpoint, potentially allowing privilege escalation or unauthorized modification of application settings. This vulnerability requires valid login credentials but has no complexity requirements, enabling attackers with low-level access to gain high-impact capabilities including confidentiality and integrity violations. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all YouTrack instances in your environment and document current versions; implement network-level access restrictions to YouTrack app permissions endpoints if possible. Within 7 days: Monitor access logs for suspicious requests to permission endpoints; isolate non-critical YouTrack instances if running vulnerable versions. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today