EUVD-2026-39655Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Authorization bypass on an app endpoint typically needs a low-privilege account (PR:L); impact is limited to tampering with project settings (I:L), with no confidentiality or availability effect.
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings
AnalysisAI
Improper authorization in JetBrains YouTrack's app configurations endpoint lets remote attackers modify project settings they should not be permitted to change, affecting all versions before 2026.2.16593. The flaw (CWE-862, Missing Authorization) impacts integrity only - no data disclosure or service disruption - and was self-reported by JetBrains with a patch already available. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 5th percentile).
Technical ContextAI
YouTrack is JetBrains' web-based issue-tracking and project-management server (CPE cpe:2.3:a:jetbrains:youtrack). The root cause is CWE-862 (Missing Authorization): the application's app-configurations endpoint performs an action - modifying project settings - without correctly verifying that the requester holds the required permission. This is a server-side access-control gap in the API authorization layer rather than a memory-safety or injection bug; the endpoint executes the privileged operation based on the request alone instead of enforcing a project-administration permission check.
RemediationAI
Vendor-released patch: upgrade JetBrains YouTrack to version 2026.2.16593 or later, which corrects the authorization check on the app configurations endpoint; this is the primary and only confirmed fix, per the JetBrains advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. If immediate upgrade is not possible, reduce exposure by restricting network reach to the YouTrack instance - place it behind VPN or an allowlisted reverse proxy so the configurations endpoint is not reachable from untrusted networks (trade-off: blocks remote/SaaS-style access for legitimate external users), and audit project-settings change logs for unexpected modifications. For JetBrains Cloud-hosted YouTrack, the fix is applied by the vendor and no customer action is required.
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. Rated critical severity (CVSS 9.1),
Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alt
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today