EUVD-2026-72514
GHSA-jgfw-8cqw-4r27
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Network-exploitable by any authenticated user (PR:L); no complexity or interaction needed; scope change justified because authorization bypass affects entities outside the user's permitted scope.
Primary rating from Vendor (JetBrains).
CVSS VectorVendor: JetBrains
Lifecycle Timeline
4DescriptionCVE.org
In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission
AnalysisAI
Incorrect authorization in JetBrains YouTrack before versions 2025.3.160480 and 2026.1.14047 allows authenticated low-privilege users to modify linked issue entities they lack update permission on by issuing PUT requests directly to link sub-resources. The flaw bypasses YouTrack's permission model at the HTTP method level, enabling integrity violations across project boundaries-reflected in the CVSS scope change (S:C). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated YouTrack user account with at least minimal access (PR:L); completely unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 rating with AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N accurately characterizes a realistic threat: any authenticated YouTrack user-including low-privilege reporters or commenters-can tamper with issue links across project boundaries. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade YouTrack to version 2025.3.160480 or later (for the 2025.3 branch) or to 2026.1.14047 or later (for the 2026.1 branch) as confirmed by the JetBrains security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all deployed YouTrack instances and verify which versions are running; audit teams using cross-project issue linking functionality and document sensitive projects affected. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. Rated critical severity (CVSS 9.1),
Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alt
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today