What is the CVSS score of CVE-2026-57922?

CVE-2026-57922 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-57922?

Yes, a patch is available for CVE-2026-57922. Update the affected software to the latest version immediately.

JetBrains YouTrack CVE-2026-57922

EUVD-2026-39654 MEDIUM

Missing Authorization (CWE-862)

2026-06-26 JetBrains

GHSA-r8gf-2mrm-r9vw

Authentication Bypass Youtrack JetBrains

5.3

CVSS 3.1 · NVD

Severity by source

Vendor (JetBrains) PRIMARY

LOW

qualitative

NVD

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Requires authenticated account (PR:L) and non-trivial MCP request crafting (AC:H); only project settings confidentiality exposed (C:L), no integrity or availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (JetBrains).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Jun 27, 2026 - 19:37 NVD

LOW MEDIUM

CVSS changed

Jun 27, 2026 - 19:37 NVD

3.1 (LOW) 5.3 (MEDIUM)

Patch available

Jun 26, 2026 - 15:01 EUVD

Analysis Generated

Jun 26, 2026 - 13:52 vuln.today

DescriptionNVD

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible

AnalysisAI

Project settings disclosure in JetBrains YouTrack before version 2026.2.16593 allows an authenticated low-privileged user to read project configuration data they are not authorized to access via the MCP (Model Context Protocol) integration. The root cause is a missing authorization check (CWE-862) on MCP-exposed endpoints, meaning the server returns project settings without validating the requesting user's project-level permissions. No public exploit has been identified at time of analysis, no KEV listing exists, and a vendor-released patch is available.

Technical ContextAI

JetBrains YouTrack is an enterprise issue tracking and project management platform. The affected component is the MCP (Model Context Protocol) integration layer - a mechanism that allows AI assistants and external tooling to interact programmatically with YouTrack data. CWE-862 (Missing Authorization) describes a failure to enforce access control at a sensitive resource endpoint: the MCP handler exposes project settings without verifying that the authenticated caller holds the necessary project-level permissions. CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* covers all YouTrack installations (cloud and on-premise) across all versions prior to 2026.2.16593. The tag 'Authentication Bypass' in the input is somewhat imprecise - the attacker is still required to be authenticated; the bypass is of authorization (permission) checks within the application, not of the authentication layer itself.

RemediationAI

The primary remediation is to upgrade JetBrains YouTrack to version 2026.2.16593 or later, which addresses the missing authorization check in the MCP integration per the vendor advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. If an immediate upgrade is not operationally feasible, a compensating control is to disable or restrict access to the MCP integration entirely - this eliminates the vulnerable code path but will break any AI assistant or external tool integrations relying on MCP. Alternatively, enforcing strict network-layer access controls to limit which authenticated user accounts can reach MCP endpoints reduces the attack surface, though this requires network-level segmentation and does not address the root authorization flaw. Patch version 2026.2.16593 is confirmed by the vendor release.