What is the CVSS score of CVE-2026-49367?

CVE-2026-49367 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of JetBrains IntelliJ IDEA are affected by CVE-2026-49367?

JetBrains IntelliJ IDEA versions prior to 2026.1.1 contain a remote command execution vulnerability accessible through the collaborative development feature that allows guest-level users to execute…. A patch is available.

How to fix or mitigate CVE-2026-49367?

Within 24 hours: Audit all IntelliJ IDEA deployments to identify instances with guest/collaborative access enabled; prioritize machines running CI/CD jobs, builds, or code deployment. Within 7 days: Disable guest access and collaborative networking features in IntelliJ IDEA settings as interim control; monitor JetBrains vendor advisories for version 2026.1.1 release timeline. Within 30 days: Deploy version 2026.1.1 or later to all affected systems upon vendor release and validate collaborative feature functionality post-patch.

JetBrains IntelliJ IDEA CVE-2026-49367

EUVD-2026-33415 HIGH

Missing Authorization (CWE-862)

2026-05-29 JetBrains

GHSA-gjhj-r92c-v3ff

Authentication Bypass Intellij Idea

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 29, 2026 - 20:02 EUVD

Analysis Generated

May 29, 2026 - 18:53 vuln.today

DescriptionCVE.org

In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account

AnalysisAI

Command execution in JetBrains IntelliJ IDEA versions prior to 2026.1.1 allows attackers leveraging the guest user account to run arbitrary commands on the host. The flaw, reported by JetBrains and tagged as an authentication bypass affecting the IDE's collaborative/guest-access functionality, carries a CVSS 8.0 (High) rating with network attack vector but requires low-privilege access and user interaction. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

JetBrains IntelliJ IDEA is a widely deployed integrated development environment for JVM and polyglot software development; it supports collaborative coding sessions (Code With Me / guest sessions) where a host shares a workspace with remote guests who connect under a restricted guest user account. The CWE-862 (Missing Authorization) classification indicates that the IDE failed to enforce proper authorization checks on actions reachable from the guest context, allowing a guest principal to invoke functionality that should have been gated to the host or higher-privileged user - in this case, command execution against the host environment. The CPE cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:* indicates the wildcard version range is affected up to the fixed build 2026.1.1.

RemediationAI

Upgrade IntelliJ IDEA to version 2026.1.1 or later, which is the Vendor-released patch: 2026.1.1 per JetBrains' fixed-issues advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. Until the upgrade is rolled out across developer workstations, compensating controls include disabling the Code With Me / guest collaboration plugin (Settings → Plugins → disable Code With Me) which removes the guest attack surface entirely at the cost of losing real-time pair-programming functionality, restricting guest sessions to authenticated, internally trusted users only via JetBrains organization/policy settings, and instructing developers not to accept guest connections from untrusted parties. Network-level controls such as blocking outbound connections to JetBrains' relay servers can also prevent guest sessions from being established but will break legitimate collaboration workflows.