EUVD-2026-38007
GHSA-v6fr-2xp3-xpr7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable account function with low complexity and no UI, but requires an existing low-privilege account (PR:L); successful account takeover yields total impact (C/I/A:H).
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
11DescriptionNVD
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible
AnalysisAI
Privilege escalation in JetBrains Hub (versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429) allows an authenticated attacker to attach additional authentication details to existing accounts, enabling unauthorized access and elevation of privileges. The flaw, self-reported by JetBrains and patched, carries a CVSS 8.8 with high impact to confidentiality, integrity, and availability; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.41%).
Technical ContextAI
JetBrains Hub is the centralized identity, single sign-on, and access-management service that ties together JetBrains team tools (YouTrack, TeamCity, Upsource), acting as the authentication broker and account directory for those products. The affected component per the CPE is cpe:2.3:a:jetbrains:hub across all versions below the listed fixes. The root cause is classified as CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), commonly known as mass-assignment or object-attribute injection: the application allows a request to bind or attach attributes - here, authentication credentials/details - to an account object that the user should not be permitted to modify. By attaching attacker-controlled authentication details to a target account, the trust relationship Hub uses for identity assertions is subverted, turning an authorization bug into an account-takeover/privilege-escalation primitive.
RemediationAI
Vendor-released patch: upgrade JetBrains Hub to the fixed build for your release line - 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, or 2024.2.148429 (or later), per the JetBrains fixed-issues advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. No vendor workaround is documented; until patching, reduce exposure by restricting network access to the Hub administration and account-management endpoints to trusted networks/VPN (trade-off: may break remote SSO flows for legitimate users), tightening who can hold Hub accounts and reviewing/limiting low-privilege account provisioning since the attack requires an authenticated foothold, and auditing accounts for unexpected or recently attached authentication details/login methods as an indicator of attempted abuse. After upgrading, review account authentication bindings for anomalies, as patching does not retroactively remove any maliciously attached credentials.
Resource exhaustion DoS in @anephenix/hub (npm) before 0.2.16 allows any unauthenticated remote client to exhaust server
Privileged GITHUB_TOKEN exfiltration in the meltano/hub repository allows any unauthenticated attacker who can open a pu
Insecure permissions in Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows authenticated attackers with low-leve
Authentication bypass in JetBrains Hub (the identity and account-management server behind TeamCity, YouTrack, and other
Account takeover in JetBrains Hub is possible through predictable restore codes, affecting all versions prior to 2026.1.
Hub v2.0 property management system allows unauthenticated arbitrary file upload via /utils/uploadFile. Malicious PDF fi
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. Rated critical severity (CVSS 9.8), this vulne
In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed. Rated critical severity
In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset. Rated critical severity (CVSS
JetBrains Hub before 2025.3.119807 has an authentication bypass allowing administrative actions without proper credentia
JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). Rated critical severity (C
The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlin
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today