EUVD-2026-33394
GHSA-gc2g-wv59-8j3r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas
AnalysisAI
Improper access control in JetBrains YouTrack before 2026.1.13570 permits any authenticated low-privileged user to enumerate restricted issues and articles through the Planning Canvas feature, exposing confidential project data they are not authorized to view. Rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), the flaw allows user-controlled identifiers to bypass access restrictions without proper authorization checks. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Technical ContextAI
JetBrains YouTrack is a proprietary web-based project management and issue tracking platform. The Planning Canvas is a visual agile board feature that renders issues and articles across projects. CWE-639 (Authorization Bypass Through User-Controlled Key) indicates the root cause: the application uses user-supplied resource identifiers - such as issue IDs or article IDs - to retrieve objects without consistently verifying that the requesting authenticated principal holds the required access rights to those specific resources. This is a classic IDOR (Insecure Direct Object Reference) pattern. The affected CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* covers all YouTrack application versions, with the fix boundary at build 2026.1.13570.
RemediationAI
Upgrade JetBrains YouTrack to version 2026.1.13570 or later, which contains the vendor-released patch for this issue per the JetBrains security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. If immediate upgrading is not feasible, as a compensating control restrict Planning Canvas access permissions to only explicitly trusted users through YouTrack's project-level access control settings - note this may reduce collaborative visibility. Additionally, audit user accounts with low-privilege access on YouTrack instances hosting sensitive or restricted projects, and revoke accounts that no longer require access. These controls do not eliminate the underlying flaw and should be treated as temporary measures only.
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. Rated critical severity (CVSS 9.1),
Authenticated users in JetBrains YouTrack versions prior to 2025.3.121962 can bypass authorization controls to access th
In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible. Rated high severity (CVSS 8.8), this
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today