EUVD-2026-72495
GHSA-fxcm-p8cw-r92m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege YouTrack account
-
DeliveryIdentify REST API endpoints for restricted resources
-
ExploitSubstitute or enumerate foreign object identifiers in API requests
-
ExecutionServer skips authorization check (CWE-862)
-
ImpactRead or modify restricted project data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid YouTrack account with at least low-privilege access (any registered user, including guest or read-only roles, may qualify depending on the installation's configuration). The attacker must be able to reach the YouTrack REST API over the network. No special non-default configuration is required - the missing authorization affects the standard REST API present in all deployments. Exploitation is limited by the need for a valid session credential; fully unauthenticated access is not possible per the CVSS PR:L metric. Scope is further limited to YouTrack installations running affected versions on the 2025.3 or 2026.1/2026.2 branches; other branches are not confirmed affected. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) scores 8.1, reflecting a genuine high-severity issue: low-complexity, network-exploitable, requiring only a valid user account. Because YouTrack is typically deployed as a developer-facing issue tracker, any registered user - including contractors, external collaborators, or compromised accounts - could pivot to restricted projects or issues. No KEV listing is present, indicating no confirmed active exploitation at time of analysis. No public exploit code has been identified. EPSS data is not provided, so exploitation probability is unquantifiable from the input. The combination of PR:L (any authenticated user) and C:H/I:H suggests the risk is real and broadly applicable across multi-tenant or multi-project YouTrack instances; the absence of A:H limits denial-of-service exposure but the data exfiltration and tampering potential is significant. |
| Exploit ScenarioDerived | An authenticated YouTrack user with access to one project crafts REST API requests substituting the resource identifiers of issues, attachments, or settings belonging to a restricted project they do not have access to. By iterating or guessing identifiers, they enumerate and exfiltrate restricted issue data or modify issue fields - for example, closing security-sensitive bug reports or altering priorities - across project boundaries without triggering authorization errors. No public exploit code has been identified at time of analysis, but the technique is trivially reproducible by any developer familiar with REST API testing. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 07, 2026
Missing authorization in JetBrains YouTrack's REST API allows authenticated low-privileged users to access and modify restricted resources via Insecure Direct Object Reference (IDOR). Affected versions span all YouTrack releases prior to 2026.2.18788, 2026.1.14055, and 2025.3.161254 across three active release branches. An attacker with any valid account can enumerate or directly reference object identifiers in REST API calls to read or write data they should not have access to, with high confidentiality and integrity impact per the CVSS vector.
Earlier versions of this analysis (1)
Missing authorization in JetBrains YouTrack's REST API allows authenticated low-privilege users to access and manipulate restricted resources via Insecure Direct Object Reference (IDOR), achieving high confidentiality and integrity impact. Multiple active release trains are affected across versions prior to 2026.2.18788, 2026.1.14055, and 2025.3.161254. No public exploit code has been identified at time of analysis, but the low attack complexity and authenticated-only prerequisite make this a realistic threat in any multi-user YouTrack deployment.
RemediationAI
Upgrade JetBrains YouTrack to one of the patched builds: 2026.2.18788, 2026.1.14055, or 2025.3.161254, depending on the active release branch in use. JetBrains has confirmed the patch is available via their vendor advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. For YouTrack Cloud instances, JetBrains typically applies patches automatically; on-premises administrators should apply the update promptly. Until patching is complete, a compensating control is to restrict YouTrack REST API access at the network perimeter (e.g., firewall or reverse-proxy rules) to known IP ranges or internal networks only - note this will break integrations and CI/CD pipelines that call the API from external hosts. Auditing REST API access logs for anomalous cross-project resource access may help detect prior exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetBrains YouTrack is a web-based issue tracker and project management platform commonly deployed by software development organizations. The REST API exposes project resources - issues, comments, attachments, workflows, access roles - behind authorization checks. CWE-862 (Missing Authorization) describes a failure where the server authenticates the caller but omits the authorization decision for a given resource or action. In IDOR exploitation, the object identifier (e.g., numeric issue ID or entity UUID embedded in the REST URL) is manipulated to reference a resource the caller does not legitimately own or have access to, and the server honors the request without validating ownership or role membership. CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* confirms all YouTrack variants are affected prior to the fixed builds.
Know when Youtrack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-accessible REST API, no complexity, any authenticated user exploits IDOR; no availability impact stated in description or CVSS.
Primary rating from Vendor (JetBrains).
CVSS VectorVendor: JetBrains
Lifecycle Timeline
4DescriptionCVE.org
In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR
Executive ViewAI
JetBrains YouTrack deployments are vulnerable to unauthorized access of project data by any employee with account credentials, creating exposure of confidential project plans, roadmaps, and business-sensitive information that may violate data governance policies or competitive security practices.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an auth
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notifi
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Exploit-DB