What is the CVSS score of EUVD-2026-38007?

EUVD-2026-38007 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of JetBrains Hub are affected by EUVD-2026-38007?

JetBrains Hub (used for team identity and access management) contains a privilege escalation vulnerability (CVSS 8.8) allowing authenticated users to hijack accounts and assume higher privileges; no…. A patch is available.

How to fix or mitigate EUVD-2026-38007?

Within 24 hours: Inventory all JetBrains Hub deployments and confirm current versions. Within 7 days: Upgrade all instances to Hub 2026.1.13757 or later, 2025.3.148033 or later, 2025.2.148048 or later, 2025.1.148120 or later, 2024.3.148430 or later, or 2024.2.148429 and later depending on your version line. Within 30 days: Audit authentication logs and account modifications from the past 90 days for unauthorized account alterations or suspicious privilege escalations.

JetBrains Hub EUVD-2026-38007

| CVE-2026-56142 HIGH

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-06-19 JetBrains

GHSA-v6fr-2xp3-xpr7

Privilege Escalation Hub

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (JetBrains) PRIMARY

CRITICAL

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable account function with low complexity and no UI, but requires an existing low-privilege account (PR:L); successful account takeover yields total impact (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (JetBrains).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 26, 2026 - 13:13 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 26, 2026 - 13:12 vuln.today

v4 (cvss_changed)

Severity Changed

Jun 26, 2026 - 13:07 NVD

CRITICAL HIGH

CVSS changed

Jun 26, 2026 - 13:07 NVD

9.9 (CRITICAL) 8.8 (HIGH)

Patch available

Jun 19, 2026 - 14:31 EUVD

Analysis Updated

Jun 19, 2026 - 13:58 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 19, 2026 - 13:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 19, 2026 - 13:52 vuln.today

cvss_changed

CVSS changed

Jun 19, 2026 - 13:52 NVD

9.6 (CRITICAL) 9.9 (CRITICAL)

Analysis Generated

Jun 19, 2026 - 13:01 vuln.today

CVE Published

Jun 19, 2026 - 11:49 cve.org

CRITICAL 9.6

DescriptionNVD

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible

AnalysisAI

Privilege escalation in JetBrains Hub (versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429) allows an authenticated attacker to attach additional authentication details to existing accounts, enabling unauthorized access and elevation of privileges. The flaw, self-reported by JetBrains and patched, carries a CVSS 8.8 with high impact to confidentiality, integrity, and availability; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.41%).

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as low-privilege Hub user

Delivery

Craft account-modification request

Exploit

Attach authentication details to target account

Execution

Authenticate as elevated account

Impact

Gain access to integrated tools

Access

Authenticate as low-privilege Hub user

Delivery

Craft account-modification request

Exploit

Attach authentication details to target account

Execution

Authenticate as elevated account

Impact

Gain access to integrated tools

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to already possess a valid authenticated JetBrains Hub account (CVSS PR:L), reachable over the network (AV:N), with no user interaction and low attack complexity. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are moderately consistent and point to a real but not emergency-grade priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with a low-privilege but valid JetBrains Hub account sends a crafted account-management request that attaches their own authentication details (e.g., an additional login credential or identity binding) to a higher-privilege target account, then authenticates as that account to gain its access across Hub-integrated tools. Given AV:N/AC:L, this requires only network reachability to Hub and no user interaction, though it depends on the attacker first holding any authenticated session; no public POC is identified at time of analysis.
Remediation	Vendor-released patch: upgrade JetBrains Hub to the fixed build for your release line - 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, or 2024.2.148429 (or later), per the JetBrains fixed-issues advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report.