Skip to main content

JetBrains YouTrack EUVDEUVD-2026-39657

| CVE-2026-57925 MEDIUM
Missing Authorization (CWE-862)
2026-06-26 JetBrains GHSA-qpjq-4h8h-5xxf
Authentication Bypass Youtrack
5.3
CVSS 3.1 · NVD
Share

Severity by source

Vendor (JetBrains) PRIMARY
MEDIUM
qualitative
NVD
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vuln.today AI
4.3 MEDIUM

Network-reachable via web/API, low complexity, requires authenticated low-privilege account; only confidentiality is impacted at low severity with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (JetBrains).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

3
CVSS changed
Jun 27, 2026 - 19:37 NVD
4.3 (MEDIUM) 5.3 (MEDIUM)
Patch available
Jun 26, 2026 - 15:01 EUVD
Analysis Generated
Jun 26, 2026 - 13:50 vuln.today

DescriptionNVD

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags

AnalysisAI

Improper access control in JetBrains YouTrack before version 2026.2.16593 permits authenticated low-privileged users to read saved queries and tags outside their authorized scope. The flaw stems from missing authorization checks (CWE-862), meaning the application fails to verify whether the requesting user holds the required permissions before serving these resources over the network. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain valid YouTrack credentials
Delivery
Authenticate to exposed YouTrack instance
Exploit
Issue crafted request to saved queries or tags endpoint
Execution
Receive unauthorized query/tag data
Impact
Enumerate sensitive project structure or workflow metadata
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an active, authenticated YouTrack session with at least low-level privileges (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 4.3 (Medium) reflects the limited blast radius: AV:N means the vulnerability is remotely reachable, AC:L indicates no special conditions, but PR:L confirms authentication is required, and the impact is confined to confidentiality at a low level (C:L/I:N/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated YouTrack user with minimal privileges - such as a contractor or a user with read-only project access - crafts a request to the YouTrack API endpoint responsible for listing saved queries or tags. Due to the missing authorization check, the server returns saved queries or tags belonging to other users or restricted projects, potentially revealing sensitive issue filters, internal project naming conventions, or confidential tag taxonomies. …
Remediation Upgrade JetBrains YouTrack to build 2026.2.16593 or later, which contains the vendor-released patch for this issue. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Youtrack

View all
CVE-2026-62422 CRITICAL
10.0 Jul 14

Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
CVE-2024-54154 CRITICAL
9.8 Dec 04

In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
CVE-2022-24442 CRITICAL
9.8 Feb 25

JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
CVE-2021-43185 CRITICAL
9.8 Nov 09

JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this

CVE-2021-25770 CRITICAL
9.8 Feb 03

In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
CVE-2019-12852 CRITICAL
9.8 Jul 03

An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
CVE-2019-12867 CRITICAL
9.8 Jul 03

Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
CVE-2019-12866 CRITICAL
9.8 Jul 03

An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains

CVE-2019-12850 CRITICAL
9.8 Jul 03

A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
CVE-2021-37549 CRITICAL
9.1 Aug 06

In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. Rated critical severity (CVSS 9.1),
CVE-2026-28193 HIGH
8.8 Feb 25

Authenticated users in JetBrains YouTrack versions prior to 2025.3.121962 can bypass authorization controls to access th
CVE-2021-25765 HIGH
8.8 Feb 03

In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible. Rated high severity (CVSS 8.8), this

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2025-20362 MEDIUM POC
6.5
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

EUVD-2026-39657 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy