EUVD-2026-39656
GHSA-2843-jvg8-9qxp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible default misconfiguration requiring low-privilege authentication; only confidentiality impact (user profile data exposure) applies, with no integrity or availability consequence.
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
AnalysisAI
Excessive user profile data disclosure in JetBrains YouTrack before 2026.2.16593 results from overly permissive default role configuration, allowing any authenticated low-privilege user to read more user profile attributes than intended. The root cause is CWE-276 (Incorrect Default Permissions), where the shipped default role grants broader read access to user directory data than the principle of least privilege requires. No public exploit or confirmed active exploitation exists at time of analysis.
Technical ContextAI
JetBrains YouTrack is a web-based project management and issue tracking platform widely used in software development organizations. The vulnerability maps to CWE-276 (Incorrect Default Permissions), indicating that the application ships with role definitions that grant excessive read access to user profile data by default, without requiring administrator intervention to introduce the exposure. Per CPE string cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*, all YouTrack versions prior to 2026.2.16593 carry this misconfigured default. The CVSS vector AV:N/AC:L/PR:L confirms the flaw is exploitable over the network by any authenticated user with low privileges, with no additional complexity or user interaction required.
RemediationAI
Upgrade JetBrains YouTrack to version 2026.2.16593 or later, which corrects the default role configuration to prevent exposure of excessive user profile details. The vendor advisory confirming the fix is at https://www.jetbrains.com/privacy-security/issues-fixed/. As a compensating control before patching, administrators can manually audit and restrict default role permissions in the YouTrack administration panel, specifically limiting which user profile fields are visible to low-privilege roles; note that this manual tightening requires deliberate effort and may need to be revalidated after future upgrades if defaults are reset. Organizations with strict privacy requirements should treat this as higher priority given the potential for internal user enumeration.
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Unauthenticated database backup disclosure in JetBrains YouTrack before 2025.3.156085, 2026.1.13913, and 2026.2.18112 al
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. Rated critical severity (CVSS 9.1),
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today