EUVD-2026-39653
GHSA-q339-r244-45h2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network endpoint (AV:N/PR:N/UI:N) with low complexity leaking private data yields C:H; no write or availability impact, so I:N/A:N and scope unchanged.
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint
AnalysisAI
Information disclosure in JetBrains YouTrack before 2026.2.16593 allows remote attackers to read other users' private data through a missing authorization check on the comment templates endpoint. The flaw is unauthenticated and network-reachable per the CVSS vector (PR:N), exposing confidential information without any user interaction. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.16%, 6th percentile).
Technical ContextAI
YouTrack is JetBrains' web-based issue-tracking and project-management platform, typically deployed as a server (CPE cpe:2.3:a:jetbrains:youtrack) accessible over HTTP/HTTPS. The vulnerability is classified as CWE-862 (Missing Authorization), meaning a specific REST/application endpoint - here the comment templates feature - fails to enforce per-user access control before returning data. As a result, the server performs the requested read operation without verifying that the caller is entitled to the underlying records, leaking data scoped to other users. The 'Authentication Bypass' tag reinforces that the access-control gap, rather than a memory-safety or injection bug, is the root cause.
RemediationAI
Upgrade YouTrack to version 2026.2.16593 or later, which is the vendor-released patch that fixes the missing authorization check (Vendor-released patch: 2026.2.16593); JetBrains-hosted (InCloud) instances are typically updated automatically, while self-managed servers must be upgraded manually. Consult the JetBrains advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ for release details. If immediate patching is not possible, reduce exposure by restricting network access to the YouTrack instance - for example placing it behind a VPN or IP allowlist and blocking direct internet access to the application - accepting the trade-off that legitimate remote users will also be gated; because the vulnerable functionality is the comment templates endpoint, monitoring or rate-limiting that endpoint at a reverse proxy can serve as an interim detective control, though it does not eliminate the unauthorized-read risk.
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. Rated critical severity (CVSS 9.1),
Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alt
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today