Skip to main content

JetBrains YouTrack CVE-2026-57922

| EUVDEUVD-2026-39654 MEDIUM
Missing Authorization (CWE-862)
2026-06-26 JetBrains GHSA-r8gf-2mrm-r9vw
Authentication Bypass Youtrack
5.3
CVSS 3.1 · NVD
Share

Severity by source

Vendor (JetBrains) PRIMARY
LOW
qualitative
NVD
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
3.1 LOW

Requires authenticated account (PR:L) and non-trivial MCP request crafting (AC:H); only project settings confidentiality exposed (C:L), no integrity or availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (JetBrains).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

4
Severity Changed
Jun 27, 2026 - 19:37 NVD
LOW MEDIUM
CVSS changed
Jun 27, 2026 - 19:37 NVD
3.1 (LOW) 5.3 (MEDIUM)
Patch available
Jun 26, 2026 - 15:01 EUVD
Analysis Generated
Jun 26, 2026 - 13:52 vuln.today

DescriptionNVD

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible

AnalysisAI

Project settings disclosure in JetBrains YouTrack before version 2026.2.16593 allows an authenticated low-privileged user to read project configuration data they are not authorized to access via the MCP (Model Context Protocol) integration. The root cause is a missing authorization check (CWE-862) on MCP-exposed endpoints, meaning the server returns project settings without validating the requesting user's project-level permissions. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain valid YouTrack account credentials
Delivery
Access MCP integration endpoint over network
Exploit
Craft MCP request targeting restricted project settings
Execution
Server skips authorization check (CWE-862)
Impact
Receive project configuration data for unauthorized project
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid YouTrack account (authenticated access, PR:L per CVSS vector) - unauthenticated external attackers cannot exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD-assigned CVSS 3.1 base score is 3.1 (Low), reflecting a narrow impact profile: only confidentiality of project settings is affected (C:L), with no integrity or availability impact (I:N/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated YouTrack user with low project privileges sends a crafted request to the YouTrack MCP interface targeting a project for which they lack administrative or settings-view access. Because the MCP handler omits the authorization check (CWE-862), the server returns project settings data without enforcing project-level permissions. …
Remediation The primary remediation is to upgrade JetBrains YouTrack to version 2026.2.16593 or later, which addresses the missing authorization check in the MCP integration per the vendor advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Youtrack

View all
CVE-2026-62422 CRITICAL
10.0 Jul 14

Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
CVE-2024-54154 CRITICAL
9.8 Dec 04

In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
CVE-2022-24442 CRITICAL
9.8 Feb 25

JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
CVE-2021-43185 CRITICAL
9.8 Nov 09

JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this

CVE-2021-25770 CRITICAL
9.8 Feb 03

In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
CVE-2019-12852 CRITICAL
9.8 Jul 03

An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
CVE-2019-12867 CRITICAL
9.8 Jul 03

Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
CVE-2019-12866 CRITICAL
9.8 Jul 03

An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains

CVE-2019-12850 CRITICAL
9.8 Jul 03

A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
CVE-2021-37549 CRITICAL
9.1 Aug 06

In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. Rated critical severity (CVSS 9.1),
CVE-2026-28193 HIGH
8.8 Feb 25

Authenticated users in JetBrains YouTrack versions prior to 2025.3.121962 can bypass authorization controls to access th
CVE-2021-25765 HIGH
8.8 Feb 03

In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible. Rated high severity (CVSS 8.8), this

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2025-20362 MEDIUM POC
6.5
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-57922 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy