EUVD-2026-39655Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach YouTrack configurations endpoint
-
ExploitSend crafted settings-modification request
-
ExecutionBypass missing authorization check
-
ImpactAlter project settings without permission
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to a YouTrack instance running a version before 2026.2.16593 and a request to the app configurations endpoint that performs project-settings modification. The published CVSS vector indicates no special preconditions (PR:N/UI:N/AC:L), but because the underlying weakness is an authorization bypass on an application endpoint, a valid session or low-privilege account may in practice be needed - this should be confirmed with JetBrains. Limiting factors: only integrity of project settings is affected (no confidentiality or availability impact), the action is not automatable per CISA SSVC, and instances restricted to internal/VPN networks are not remotely reachable. |
| Impact | Signals are mixed and lean toward moderate, not critical, real-world risk. The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:N = 7.5) implies trivial network exploitation with no privileges and high integrity impact, but CISA SSVC scores Exploitation: none, Automatable: no, Technical Impact: partial - the 'partial' technical impact and 'not automatable' contradict the I:H rating and suggest a scoped settings-tampering issue rather than full system compromise. EPSS is low (0.16%), there is no KEV listing, and no public exploit is known. A notable tension: the vector claims PR:N (unauthenticated) yet the flaw is an authorization bypass on an authenticated application endpoint - verify with the vendor whether any session/account is actually required, as PR:N may overstate ease of reach. Overall this is a real but lower-urgency integrity issue; patch on a normal cycle unless YouTrack is internet-exposed. |
| Exploit ScenarioDerived | An attacker reaches the network-accessible YouTrack app configurations endpoint and issues a crafted request to alter project settings that should require project-administrator permission, tampering with project configuration without proper authorization. With AC:L and (per the published vector) no privileges or user interaction required, the request is straightforward to send; no public proof-of-concept is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 27, 2026
Improper authorization in JetBrains YouTrack's app configurations endpoint lets remote attackers modify project settings they should not be permitted to change, affecting all versions before 2026.2.16593. The flaw (CWE-862, Missing Authorization) impacts integrity only - no data disclosure or service disruption - and was self-reported by JetBrains with a patch already available. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 5th percentile).
Earlier versions of this analysis (2)
Improper authorization in JetBrains YouTrack's app configurations endpoint lets attackers modify project settings without proper permission checks, affecting all versions before 2026.2.16593. The flaw maps to CWE-862 (Missing Authorization) and carries an integrity-only impact (CVSS 7.5, I:H). There is no public exploit identified at time of analysis, EPSS exploitation probability is low (0.16%, 5th percentile), and it is not listed in CISA KEV.
Improper authorization in JetBrains YouTrack before build 2026.2.16593 permits authenticated low-privilege users to modify project settings via the app configurations endpoint, bypassing intended access controls. Affected are all YouTrack deployments running versions prior to 2026.2.16593, as identified by CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis, though the integrity impact is rated high given that unauthorized project configuration changes can disrupt development workflows or escalate privilege within the project scope.
RemediationAI
Vendor-released patch: upgrade JetBrains YouTrack to version 2026.2.16593 or later, which corrects the authorization check on the app configurations endpoint; this is the primary and only confirmed fix, per the JetBrains advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. If immediate upgrade is not possible, reduce exposure by restricting network reach to the YouTrack instance - place it behind VPN or an allowlisted reverse proxy so the configurations endpoint is not reachable from untrusted networks (trade-off: blocks remote/SaaS-style access for legitimate external users), and audit project-settings change logs for unexpected modifications. For JetBrains Cloud-hosted YouTrack, the fix is applied by the vendor and no customer action is required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
YouTrack is JetBrains' web-based issue-tracking and project-management server (CPE cpe:2.3:a:jetbrains:youtrack). The root cause is CWE-862 (Missing Authorization): the application's app-configurations endpoint performs an action - modifying project settings - without correctly verifying that the requester holds the required permission. This is a server-side access-control gap in the API authorization layer rather than a memory-safety or injection bug; the endpoint executes the privileged operation based on the request alone instead of enforcing a project-administration permission check.
Know when Youtrack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Authorization bypass on an app endpoint typically needs a low-privilege account (PR:L); impact is limited to tampering with project settings (I:L), with no confidentiality or availability effect.
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings
Executive ViewAI
JetBrains YouTrack contains an authorization flaw that permits remote attackers to modify project configurations they should not be permitted to change, potentially compromising project governance and workflow integrity across all YouTrack deployments running versions prior to 2026.2.16593. Although no active exploitation has been identified, the vulnerability could allow unauthorized personnel to alter critical project settings without detection.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an auth
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notifi
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
GitHub PoC
Exploit-DB