EUVD-2026-60243
GHSA-2r3v-q8q5-q22x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network-reachable endpoint requires only low-privilege authentication; deletion of arbitrary entities yields high integrity and availability impact with no confidentiality breach.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint
AnalysisAI
Missing authorization on the mailbox endpoint in JetBrains YouTrack enables any authenticated user to delete arbitrary entities across the platform, regardless of ownership or role. Affected versions span three active release branches: all releases prior to 2025.3.156085, 2026.1.13914, and 2026.2.18095. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session in JetBrains YouTrack with at minimum low-privilege access (PR:L per CVSS vector) - no administrative or elevated role is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H scores 8.1 (High), reflecting a low-friction, network-accessible attack requiring only valid credentials - no special roles, no user interaction, and no complex preconditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated YouTrack user with a basic account discovers or enumerates entity IDs through normal application browsing, then crafts HTTP DELETE requests targeting the mailbox endpoint for entities they do not own. Because the endpoint lacks authorization checks, the server processes each deletion without verifying ownership or permissions, allowing the attacker to destroy issues, projects, or other entities across the platform. … |
| Remediation | Upgrade JetBrains YouTrack to one of the following patched releases corresponding to your active branch: 2025.3.156085, 2026.1.13914, or 2026.2.18095, as confirmed by the vendor advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Review YouTrack audit logs for suspicious deletion activity, inventory all authenticated users with platform access, and establish procedures for rollback of deleted entities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today