What is the CVSS score of EUVD-2026-33377?

EUVD-2026-33377 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-33377?

Yes, a patch is available for EUVD-2026-33377. Update the affected software to the latest version immediately.

JetBrains YouTrack EUVD-2026-33377

| CVE-2026-49369 MEDIUM

Incorrect Authorization (CWE-863)

2026-05-29 JetBrains

GHSA-4535-jc6h-8qx3

Information Disclosure Authentication Bypass Youtrack

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 29, 2026 - 20:02 EUVD

Analysis Generated

May 29, 2026 - 18:59 vuln.today

DescriptionCVE.org

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages

AnalysisAI

Information disclosure in JetBrains YouTrack before version 2026.1.13162 allows authenticated low-privilege users to access sensitive user and group membership data they are not authorized to view. Rooted in CWE-863 (Incorrect Authorization), the flaw exists on the Users and Groups administrative pages, where authorization checks are insufficiently enforced for authenticated sessions. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the low access complexity means any authenticated attacker can reliably reproduce the condition.

Technical ContextAI

JetBrains YouTrack is a web-based project management and issue tracking platform commonly deployed in enterprise environments. The affected component is the Users and Groups administrative interface, which governs visibility into organizational structure, account metadata, and group assignments. CWE-863 (Incorrect Authorization) identifies the root cause as a failure to correctly verify that an authenticated user holds sufficient privileges before presenting protected resources - the system authenticates the user but does not properly enforce authorization boundaries for these specific pages. The CPE string cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* indicates all tracked versions of the application product are considered affected up to the fixed release, and the wildcard range suggests this was a longstanding authorization gap rather than a regression introduced in a specific release.

RemediationAI

The primary fix is to upgrade JetBrains YouTrack to version 2026.1.13162 or later, which is confirmed as the patched release per the JetBrains security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. Organizations unable to upgrade immediately should consider restricting access to the Users and Groups administrative pages at the network or application layer - for example, by enforcing role-based access policies that limit who can reach administrative UI paths, or by deploying a reverse proxy that requires additional authentication before serving those routes. Note that these workarounds introduce operational overhead and may break legitimate administrative workflows. Because the vulnerability requires an authenticated session, temporarily tightening account provisioning policies (e.g., disabling self-registration or guest access if enabled) can reduce the pool of potential exploiters until patching is complete.