EUVD-2026-60250
GHSA-g6q4-jqwc-9w46
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-accessible web API flaw requiring only a valid user session (PR:L); no confidentiality or integrity impact on availability; scope unchanged as the affected project data stays within the application boundary.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
AnalysisAI
Unauthorized project transfer between organizations in JetBrains YouTrack before version 2026.2.17917 exposes high-severity access control failure affecting any multi-tenant or multi-organization deployment. Any authenticated low-privileged user can transfer projects across organizational boundaries without holding the necessary authorization, resulting in high confidentiality and integrity impact against affected projects and their data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold a valid authenticated session in the YouTrack instance - confirmed by the CVSS vector PR:L (low-privileged user). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score reflects genuine, actionable risk: network-reachable (AV:N), low complexity (AC:L), low-privilege authentication required (PR:L), no user interaction needed (UI:N), with high confidentiality and integrity impact (C:H/I:H) and no availability impact (A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated low-privileged YouTrack user with access to a shared or multi-organization instance identifies a target project belonging to another organization. The attacker submits a project transfer request to the API without holding the required authorization over the target project; due to the missing authorization check, the server processes the request and transfers the project - along with all its issues, attachments, and metadata - into the attacker's organization, granting full access to the project's data. … |
| Remediation | Upgrade JetBrains YouTrack to version 2026.2.17917 or later, which is the vendor-confirmed fixed release per the advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Verify your current YouTrack version and determine if it is prior to 2026.2.17917; if vulnerable, immediately restrict project transfer permissions to explicitly authorized administrators and disable cross-organization project transfers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today