Skip to main content

JetBrains YouTrack CVE-2026-86492

| EUVDEUVD-2026-72508 HIGH
Exposure of Data Element to Wrong Session (CWE-488)
2026-09-07 JetBrains GHSA-p8f6-44xp-3cp8
Information Disclosure Youtrack JetBrains
8.5
CVSS 3.1 · Vendor: JetBrains
Share

Severity by source

Vendor (JetBrains) PRIMARY
8.5 HIGH
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
vuln.today AI
8.5 HIGH

PR:L because a valid YouTrack account is required; S:C and C:H reflect that the stolen GitHub token exposes resources in a separate organizational scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (JetBrains).

CVSS VectorVendor: JetBrains

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None

Lifecycle Timeline

3
Patch available
Sep 07, 2026 - 17:17 EUVD
Analysis Generated
Sep 07, 2026 - 17:09 vuln.today
CVE Published
Sep 07, 2026 - 16:26 cve.org
HIGH 8.5

DescriptionCVE.org

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens

AnalysisAI

Cross-tenant GitHub App installation token theft in JetBrains YouTrack before 2026.2.18634 lets any authenticated user retrieve GitHub App installation tokens belonging to other tenants due to a shared, non-isolated token cache. The root cause is CWE-488 (Exposure of Data Element to Wrong Session): cached tokens were keyed without tenant-scope isolation. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold a valid YouTrack user account at any privilege level (PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-supplied CVSS 3.1 score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) is well-calibrated: network-reachable, no special conditions, only a low-privileged YouTrack account required, and the scope change correctly reflects that the impact escapes YouTrack and lands in victim GitHub organizations. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade JetBrains YouTrack to version 2026.2.18634 or later, which resolves the shared token cache isolation defect. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, confirm your YouTrack version and whether GitHub App integration is enabled; if affected, audit access logs and GitHub API calls for unauthorized token access. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Youtrack

View all
CVE-2026-86478 CRITICAL
9.8 Sep 07

Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
CVE-2026-62422 CRITICAL
9.8 Jul 14

Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
CVE-2024-54154 CRITICAL
9.8 Dec 04

In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
CVE-2022-24442 CRITICAL
9.8 Feb 25

JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
CVE-2021-43185 CRITICAL
9.8 Nov 09

JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this

CVE-2021-25770 CRITICAL
9.8 Feb 03

In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
CVE-2019-12852 CRITICAL
9.8 Jul 03

An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
CVE-2019-12867 CRITICAL
9.8 Jul 03

Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
CVE-2019-12866 CRITICAL
9.8 Jul 03

An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains

CVE-2019-12850 CRITICAL
9.8 Jul 03

A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
CVE-2026-75045 CRITICAL
9.1 Aug 17

Unauthenticated database backup disclosure in JetBrains YouTrack before 2025.3.156085, 2026.1.13913, and 2026.2.18112 al
CVE-2021-37549 CRITICAL
9.1 Aug 06

In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. Rated critical severity (CVSS 9.1),

Same weakness CWE-488 – Exposure of Data Element to Wrong Session

View all
CVE-2024-38367 CRITICAL POC
9.6
CVE-2024-27935 HIGH POC
8.3
CVE-2026-88017 HIGH POC
7.3
CVE-2026-16498 CRITICAL
10.0
CVE-2026-16326 CRITICAL
10.0
CVE-2026-19931 CRITICAL
9.8
CVE-2024-27455 CRITICAL
9.1
CVE-2026-71850 MEDIUM POC
4.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-86492 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy