EUVD-2026-72508
GHSA-p8f6-44xp-3cp8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to YouTrack with any low-privilege account
-
DeliveryAccess shared token cache endpoint or vulnerable code path
-
ExploitRetrieve another tenant's GitHub App installation token
-
ExecutionPresent stolen token to GitHub API
-
ImpactAccess victim organization's repositories and internal data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V14 - Data Protection Exposure of data element to wrong session
|
| Exploitation Conditions | The attacker must hold a valid YouTrack user account at any privilege level (PR:L). The vulnerability is meaningful only in multi-tenant deployments - cloud-hosted YouTrack or shared on-premises instances - where at least one other tenant has an active GitHub App integration whose installation token has been cached. Single-tenant YouTrack instances have no other tenant's tokens to steal. No special attack tooling is required beyond an authenticated YouTrack session and knowledge of the cache access mechanism. The primary limiting factor is the requirement for a valid YouTrack login; unauthenticated external access to the token cache is not indicated by the available data. |
| Impact | The vendor-supplied CVSS 3.1 score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) is well-calibrated: network-reachable, no special conditions, only a low-privileged YouTrack account required, and the scope change correctly reflects that the impact escapes YouTrack and lands in victim GitHub organizations. The high confidentiality impact is credible because installation tokens may carry broad repository access permissions defined by the App - potentially including private source code, secrets in CI configuration, and deployment pipelines. The low integrity impact reflects limited write capability depending on App permissions. No EPSS data was provided in the input, and this CVE is not listed in CISA KEV, so active exploitation is unconfirmed. No public proof-of-concept has been identified. The practical risk is highest in multi-tenant SaaS or shared on-premises YouTrack deployments where multiple organizations have configured GitHub App integrations; single-tenant isolated deployments face no cross-tenant exposure. |
| Exploit ScenarioDerived | An attacker with a standard low-privilege YouTrack account in a multi-tenant deployment triggers a code path that accesses the shared token cache and retrieves a GitHub App installation token belonging to a different tenant organization. The attacker then directly calls the GitHub REST or GraphQL API using that stolen token, acting as the victim organization's GitHub App installation and gaining read access to private repositories, issues, and pull requests - and potentially write access depending on the App's configured permissions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 07, 2026
Cross-tenant GitHub App installation token theft in JetBrains YouTrack before 2026.2.18634 lets any authenticated user retrieve GitHub App installation tokens belonging to other tenants due to a shared, non-isolated token cache. The root cause is CWE-488 (Exposure of Data Element to Wrong Session): cached tokens were keyed without tenant-scope isolation. With a stolen installation token, an attacker can authenticate to the GitHub API as the victim organization's GitHub App, gaining access to that organization's repositories, pull requests, issues, and CI/CD integrations; no public exploit has been identified at time of analysis.
RemediationAI
Upgrade JetBrains YouTrack to version 2026.2.18634 or later, which resolves the shared token cache isolation defect. The vendor advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ documents the fix. For organizations unable to patch immediately, disabling or revoking GitHub App integrations within YouTrack removes the cross-tenant theft vector but interrupts GitHub-linked automation, issue synchronization, and commit tracking. After upgrading, administrators should audit GitHub App installation token activity logs for each connected organization to identify any anomalous API access originating before the patch date. On the GitHub side, revoking and re-issuing GitHub App installation tokens post-patch ensures any tokens that may have been cached and accessed by unauthorized parties are invalidated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetBrains YouTrack (CPE: cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*) is a project management and issue-tracking platform with built-in GitHub App integration, enabling automated linking of commits, pull requests, and issues. GitHub App installation tokens are short-lived OAuth bearer tokens scoped to a specific GitHub App installation within an organization; they grant the permissions defined in the App's manifest (typically repository read/write, issue management, and workflow access). CWE-488 (Exposure of Data Element to Wrong Session) describes the class of flaw where a shared mutable data structure - here, a token cache - fails to enforce per-session or per-tenant partitioning, causing one user or tenant's data to be readable by another. In this case, YouTrack's internal cache stored GitHub App installation tokens in a shared namespace, making it possible for a low-privileged user in one tenant to obtain a cached token issued for a different tenant's GitHub App installation.
Know when Youtrack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
PR:L because a valid YouTrack account is required; S:C and C:H reflect that the stolen GitHub token exposes resources in a separate organizational scope.
Primary rating from Vendor (JetBrains).
CVSS VectorVendor: JetBrains
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens
Executive ViewAI
JetBrains YouTrack before version 2026.2.18634 contains a token-isolation flaw allowing any authenticated user to steal GitHub App installation tokens from other organizations on the same instance. With stolen tokens, attackers can access victim repositories, pull requests, CI/CD pipelines, and integrations, creating a significant supply chain and code-integrity risk for multi-tenant deployments.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict YouTrack access to trusted internal authenticated users only, enforce frequent GitHub credential rotation, monitor GitHub audit logs for unauthorized API activity or repository access patterns, disable GitHub App integration if operationally feasible, and maintain detailed logging of all GitHub App token usage and authentication events.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an auth
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notifi
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Exploit-DB