EUVD-2026-39653
GHSA-q339-r244-45h2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed YouTrack instance
-
ExploitSend request to comment templates endpoint
-
ExecutionBypass missing authorization check
-
ImpactRead other users' private data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to a YouTrack instance prior to 2026.2.16593 and the ability to invoke the comment templates endpoint; the CVSS vector indicates no authentication (PR:N), no user interaction (UI:N), and low complexity (AV:N/AC:L), so the bug is reachable against affected default deployments that are network-exposed. Limiting factors that reduce real-world risk: the instance must actually be reachable by the attacker (internet-facing or otherwise accessible), the impact is confined to confidentiality (no data modification or denial of service), and exposure scales with how much private data exists in the instance. The description does not specify whether any session context is needed to hit the endpoint, so on instances fronted by SSO/reverse-proxy authentication the practical reachability should be confirmed with the vendor. |
| Impact | Signals are largely consistent and point to a moderate, confidentiality-only issue rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes easy, unauthenticated, network exploitation with high confidentiality impact but no integrity or availability effect. Counterbalancing this, EPSS is very low (0.16%, 6th percentile) and CISA SSVC rates Exploitation as 'none', Automatable 'no', and Technical Impact only 'partial' - indicating no observed exploitation and limited blast radius. The PR:N rating implies no authentication is required; however, the description does not detail whether any session or context is needed to reach the comment templates endpoint, so the practical reachability of the endpoint on hardened/SSO-fronted deployments should be verified with JetBrains. Overall this is a real but not urgent fix: patch on a normal cycle, prioritizing internet-exposed instances. |
| Exploit ScenarioDerived | An attacker who can reach a YouTrack instance over the network sends a crafted request to the comment templates endpoint and receives private data belonging to other users without needing valid credentials for those accounts. No public proof-of-concept is identified at time of analysis, but the low attack complexity (AC:L) means a working request would be straightforward to reproduce once the endpoint behavior is understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 27, 2026
Information disclosure in JetBrains YouTrack before 2026.2.16593 allows remote attackers to read other users' private data through a missing authorization check on the comment templates endpoint. The flaw is unauthenticated and network-reachable per the CVSS vector (PR:N), exposing confidential information without any user interaction. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.16%, 6th percentile).
Earlier versions of this analysis (2)
Information disclosure in JetBrains YouTrack before 2026.2.16593 lets remote unauthenticated attackers read other users' private data through the comment templates endpoint, which fails to enforce authorization (CWE-862). The flaw exposes confidential user information without any privileges or user interaction, though there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 6th percentile). JetBrains self-reported the issue and has released a fixed version.
Improper access control in JetBrains YouTrack before version 2026.2.16593 exposes other users' private data through an insufficiently protected comment templates endpoint. Any authenticated low-privileged user can query this endpoint to read private comment template data belonging to other users, bypassing intended access restrictions. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low attack complexity and broad authenticated user base in typical YouTrack deployments make it a meaningful information disclosure risk.
RemediationAI
Upgrade YouTrack to version 2026.2.16593 or later, which is the vendor-released patch that fixes the missing authorization check (Vendor-released patch: 2026.2.16593); JetBrains-hosted (InCloud) instances are typically updated automatically, while self-managed servers must be upgraded manually. Consult the JetBrains advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ for release details. If immediate patching is not possible, reduce exposure by restricting network access to the YouTrack instance - for example placing it behind a VPN or IP allowlist and blocking direct internet access to the application - accepting the trade-off that legitimate remote users will also be gated; because the vulnerable functionality is the comment templates endpoint, monitoring or rate-limiting that endpoint at a reverse proxy can serve as an interim detective control, though it does not eliminate the unauthorized-read risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
YouTrack is JetBrains' web-based issue-tracking and project-management platform, typically deployed as a server (CPE cpe:2.3:a:jetbrains:youtrack) accessible over HTTP/HTTPS. The vulnerability is classified as CWE-862 (Missing Authorization), meaning a specific REST/application endpoint - here the comment templates feature - fails to enforce per-user access control before returning data. As a result, the server performs the requested read operation without verifying that the caller is entitled to the underlying records, leaking data scoped to other users. The 'Authentication Bypass' tag reinforces that the access-control gap, rather than a memory-safety or injection bug, is the root cause.
Know when Youtrack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network endpoint (AV:N/PR:N/UI:N) with low complexity leaking private data yields C:H; no write or availability impact, so I:N/A:N and scope unchanged.
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint
Executive ViewAI
JetBrains YouTrack instances prior to version 2026.2.16593 contain an authorization bypass that allows unauthenticated remote attackers to access other users' private comments and data, exposing organizational discussions and sensitive project information to unauthorized viewing. While the current exploitation probability remains low (0.2% EPSS), the vulnerability's network accessibility and ease of discovery warrant immediate patching across all YouTrack deployments.
Apply vendor patch
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an auth
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notifi
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Exploit-DB