What is the CVSS score of EUVD-2026-38007?

EUVD-2026-38007 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of JetBrains Hub are affected by EUVD-2026-38007?

JetBrains Hub (used for team identity and access management) contains a privilege escalation vulnerability (CVSS 8.8) allowing authenticated users to hijack accounts and assume higher privileges; no…. A patch is available.

How to fix or mitigate EUVD-2026-38007?

Within 24 hours: Inventory all JetBrains Hub deployments and confirm current versions. Within 7 days: Upgrade all instances to Hub 2026.1.13757 or later, 2025.3.148033 or later, 2025.2.148048 or later, 2025.1.148120 or later, 2024.3.148430 or later, or 2024.2.148429 and later depending on your version line. Within 30 days: Audit authentication logs and account modifications from the past 90 days for unauthorized account alterations or suspicious privilege escalations.

JetBrains Hub EUVD-2026-38007

| CVE-2026-56142 HIGH

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-06-19 JetBrains

GHSA-v6fr-2xp3-xpr7

Privilege Escalation Hub

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (JetBrains) PRIMARY

CRITICAL

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable account function with low complexity and no UI, but requires an existing low-privilege account (PR:L); successful account takeover yields total impact (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (JetBrains).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 26, 2026 - 13:13 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 26, 2026 - 13:12 vuln.today

v4 (cvss_changed)

Severity Changed

Jun 26, 2026 - 13:07 NVD

CRITICAL HIGH

CVSS changed

Jun 26, 2026 - 13:07 NVD

9.9 (CRITICAL) 8.8 (HIGH)

Patch available

Jun 19, 2026 - 14:31 EUVD

Analysis Updated

Jun 19, 2026 - 13:58 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 19, 2026 - 13:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 19, 2026 - 13:52 vuln.today

cvss_changed

CVSS changed

Jun 19, 2026 - 13:52 NVD

9.6 (CRITICAL) 9.9 (CRITICAL)

Analysis Generated

Jun 19, 2026 - 13:01 vuln.today

CVE Published

Jun 19, 2026 - 11:49 cve.org

CRITICAL 9.6

DescriptionNVD

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible

AnalysisAI

Privilege escalation in JetBrains Hub (versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429) allows an authenticated attacker to attach additional authentication details to existing accounts, enabling unauthorized access and elevation of privileges. The flaw, self-reported by JetBrains and patched, carries a CVSS 8.8 with high impact to confidentiality, integrity, and availability; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.41%).

Technical ContextAI

JetBrains Hub is the centralized identity, single sign-on, and access-management service that ties together JetBrains team tools (YouTrack, TeamCity, Upsource), acting as the authentication broker and account directory for those products. The affected component per the CPE is cpe:2.3:a:jetbrains:hub across all versions below the listed fixes. The root cause is classified as CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), commonly known as mass-assignment or object-attribute injection: the application allows a request to bind or attach attributes - here, authentication credentials/details - to an account object that the user should not be permitted to modify. By attaching attacker-controlled authentication details to a target account, the trust relationship Hub uses for identity assertions is subverted, turning an authorization bug into an account-takeover/privilege-escalation primitive.

RemediationAI

Vendor-released patch: upgrade JetBrains Hub to the fixed build for your release line - 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, or 2024.2.148429 (or later), per the JetBrains fixed-issues advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. No vendor workaround is documented; until patching, reduce exposure by restricting network access to the Hub administration and account-management endpoints to trusted networks/VPN (trade-off: may break remote SSO flows for legitimate users), tightening who can hold Hub accounts and reviewing/limiting low-privilege account provisioning since the attack requires an authenticated foothold, and auditing accounts for unexpected or recently attached authentication details/login methods as an indicator of attempted abuse. After upgrading, review account authentication bindings for anomalies, as patching does not retroactively remove any maliciously attached credentials.