EUVD-2026-60248
GHSA-924r-pw97-j2gg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible web app (AV:N), any authenticated account sufficient (PR:L), complete read bypass of restricted articles (C:H), no write or availability impact (I:N/A:N).
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint
AnalysisAI
Unauthorized cross-project article disclosure in JetBrains YouTrack allows any authenticated user to read restricted knowledge base articles belonging to projects they are not authorized to access, by exploiting a missing authorization check on the draft creation endpoint. Affected are all YouTrack deployments running versions before 2026.1.13903 and 2026.2.17950. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid YouTrack user account at any privilege level - no administrative or elevated role is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is well-calibrated: network-accessible with low attack complexity, but gated behind valid authentication (PR:L), producing a 6.5 Medium score that reflects the real-world risk accurately. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated YouTrack user with access limited to a single low-sensitivity project sends a crafted POST request to the draft creation endpoint, referencing the numeric ID of an article belonging to a restricted project they do not have authorization to view. The endpoint processes the request and returns the full article body without enforcing project-level read permissions, exposing confidential documentation to the caller. … |
| Remediation | Upgrade to JetBrains YouTrack 2026.1.13903 or 2026.2.17950 (or any later release in the respective branch), as these are the vendor-confirmed fixed versions per the advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today