EUVD-2026-60244
GHSA-68v9-f358-h326
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network download of backups is low-complexity data disclosure (C:H); I set I:N and A:N because downloading a backup is a read action with no direct write or availability impact.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
AnalysisAI
Unauthenticated database backup disclosure in JetBrains YouTrack before 2025.3.156085, 2026.1.13913, and 2026.2.18112 allows a remote attacker to abuse a shared draft signature to download full database backups without any credentials. Because backups typically contain issue data, user records, and secrets, this is a high-impact confidentiality exposure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the YouTrack instance be network-reachable by the attacker and that the shared-draft-signature mechanism be usable to reach the database-backup download function - the core prerequisite is simply an exposed, unpatched YouTrack server, since the CVSS vector is AV:N/AC:L/PR:N/UI:N (no authentication, no user interaction). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are largely aligned toward high real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker with no account crafts a request presenting a shared-draft signature to the backup-download functionality of an internet-exposed YouTrack instance and retrieves a full database backup. The attacker then mines the archive offline for user records, issue contents, integration tokens, and password hashes, using recovered secrets to pivot into connected systems. … |
| Remediation | Upgrade YouTrack to a fixed build - Vendor-released patch: 2025.3.156085, 2026.1.13913, or 2026.2.18112, whichever corresponds to your release track - as the primary fix; JetBrains Cloud (InCloud) instances are typically patched automatically by the vendor, so this chiefly concerns self-hosted deployments. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all YouTrack instances and their versions in your environment, restrict network access to YouTrack and backup systems using firewall rules, and implement WAF rules to block requests targeting shared draft signature endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today