EUVD-2026-60245
GHSA-m5mc-gg37-jj4j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible endpoint requires only a low-privilege session; enumeration yields account identifiers only, with no integrity or availability impact.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint
AnalysisAI
Account enumeration in JetBrains YouTrack before version 2026.2.18112 exposes internal user accounts to any authenticated user through insufficient authorization controls on the users search endpoint. The root cause is CWE-862 (Missing Authorization): the endpoint performs no privilege check beyond requiring a valid session, allowing low-privilege users to systematically extract account identifiers across the entire instance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session on the JetBrains YouTrack instance; any user account with low-level credentials is sufficient, and no administrative privileges are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 (Medium) accurately characterizes the limited blast radius: confidentiality impact is low (account identifiers only), integrity and availability are unaffected, and the prerequisite of a valid authenticated session substantially narrows the attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds any valid YouTrack account - including a newly registered or minimally privileged one - authenticates to the instance and sends iterative queries to the users search endpoint, extracting the full roster of registered account identities. The harvested usernames and email addresses are then used to craft targeted spear-phishing campaigns or to perform credential-stuffing attacks against associated corporate services. … |
| Remediation | Upgrade JetBrains YouTrack to version 2026.2.18112 or later, which is confirmed by the vendor as the patched release addressing the missing authorization on the users search endpoint; the advisory is available at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today