What is the CVSS score of EUVD-2026-39657?

EUVD-2026-39657 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-39657?

Yes, a patch is available for EUVD-2026-39657. Update the affected software to the latest version immediately.

JetBrains YouTrack EUVD-2026-39657

| CVE-2026-57925 MEDIUM

Missing Authorization (CWE-862)

2026-06-26 JetBrains

GHSA-qpjq-4h8h-5xxf

Authentication Bypass Youtrack JetBrains

5.3

CVSS 3.1 · NVD

Severity by source

Vendor (JetBrains) PRIMARY

MEDIUM

qualitative

NVD

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable via web/API, low complexity, requires authenticated low-privilege account; only confidentiality is impacted at low severity with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (JetBrains).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jun 27, 2026 - 19:37 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

Patch available

Jun 26, 2026 - 15:01 EUVD

Analysis Generated

Jun 26, 2026 - 13:50 vuln.today

DescriptionNVD

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags

AnalysisAI

Improper access control in JetBrains YouTrack before version 2026.2.16593 permits authenticated low-privileged users to read saved queries and tags outside their authorized scope. The flaw stems from missing authorization checks (CWE-862), meaning the application fails to verify whether the requesting user holds the required permissions before serving these resources over the network. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the network-accessible nature of the issue means any authenticated user on an exposed YouTrack instance is a potential threat actor.

Technical ContextAI

JetBrains YouTrack is a web-based issue tracking and project management platform. Its saved queries (stored search filters) and tags are access-controlled resources typically scoped to individual users or projects. CWE-862 (Missing Authorization) indicates the application performs no - or an insufficient - authorization check when a request is made to retrieve these objects, even though the user is authenticated. The affected component is the server-side logic responsible for serving saved query and tag data, reachable over the network via YouTrack's web or API interface. The CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* covers all prior releases up to the fixed build 2026.2.16593.

RemediationAI

Upgrade JetBrains YouTrack to build 2026.2.16593 or later, which contains the vendor-released patch for this issue. The authoritative advisory and patch details are available at https://www.jetbrains.com/privacy-security/issues-fixed/. If an immediate upgrade is not feasible, organizations should restrict YouTrack access to trusted, internally managed user accounts only, and audit YouTrack user roles to ensure no untrusted or external accounts exist that could leverage this flaw. Restricting network access to the YouTrack instance via firewall or VPN reduces exposure but does not eliminate the vulnerability for internal threat actors. No workaround is documented by the vendor beyond applying the patch.