What is the CVSS score of EUVD-2026-33393?

EUVD-2026-33393 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-33393?

Yes, a patch is available for EUVD-2026-33393. Update the affected software to the latest version immediately.

JetBrains YouTrack EUVD-2026-33393

| CVE-2026-49385 MEDIUM

Missing Authorization (CWE-862)

2026-05-29 JetBrains

GHSA-3hmq-7764-wgw3

Authentication Bypass Youtrack

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 29, 2026 - 20:02 EUVD

Analysis Generated

May 29, 2026 - 18:56 vuln.today

DescriptionCVE.org

In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts

AnalysisAI

Improper access control in JetBrains YouTrack before version 2026.1.13570 permits any low-privileged authenticated user to modify service accounts, an administrative operation that should be restricted to privileged roles. Rooted in CWE-862 (Missing Authorization), the flaw is exploitable over the network with low complexity, requiring no user interaction - meaning any valid account holder on an exposed instance can tamper with service account configurations. No public exploit or CISA KEV listing has been identified at time of analysis, but the integrity impact is rated high given the sensitivity of service account access in YouTrack deployments.

Technical ContextAI

JetBrains YouTrack is an issue tracking and project management platform commonly deployed on-premises and as a cloud service. Service accounts in YouTrack are privileged entities used by automation pipelines, CI/CD integrations, and third-party connectors - their modification can affect the credentials and permissions underpinning these workflows. The root cause is CWE-862 (Missing Authorization): the application executes service account write operations without verifying that the requesting principal holds the required administrative role. The affected scope covers all YouTrack instances represented by CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*, confirming a broad version range prior to 2026.1.13570. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N precisely maps to a network-reachable, low-complexity, low-privilege authorization bypass with high integrity impact and no confidentiality or availability consequences directly from this flaw alone.

RemediationAI

Vendor-released patch: 2026.1.13570. Upgrade YouTrack to version 2026.1.13570 or later immediately; this is the definitive fix per the JetBrains security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. For organizations unable to patch immediately, a compensating control is to audit and restrict YouTrack user accounts - specifically, remove or suspend accounts for users who should not have access to any administrative-adjacent operations, reducing the pool of principals who could trigger this flaw. Additionally, restricting network access to the YouTrack instance to trusted internal networks or VPN reduces exposure for externally accessible deployments, at the trade-off of limiting legitimate remote access. Role-based access reviews should be conducted post-patch to identify any unauthorized service account modifications that may have already occurred.