EUVD-2026-48239
GHSA-893f-8w7m-vh3c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Network-reachable Remote Development backend with missing authorization (PR:N), read-only file access gives C:H/I:N/A:N, and reach beyond the IDE component justifies S:C.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session
AnalysisAI
Unauthorized file access in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to read files they should not be able to reach during a Remote Development session, bypassing intended authorization controls (CWE-862). The high CVSS score (8.6) reflects a scope-changed confidentiality impact, meaning the exposure can extend beyond the vulnerable component to the host system serving the remote session. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to be running IntelliJ IDEA before 2026.2 with the Remote Development feature active - the vulnerability manifests specifically 'in a Remote Development session,' so a reachable Remote Development backend is the concrete prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N = 8.6) describes a network-reachable, low-complexity, unauthenticated read-only exposure with a scope change, which is genuinely serious for confidentiality. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker able to reach an IntelliJ IDEA Remote Development backend over the network abuses the missing authorization check to request files outside the authorized project scope, retrieving sensitive host files such as credentials, keys, or source outside the intended workspace. Because the scope is changed (S:C), the read can reach beyond the IDE component into the underlying host. … |
| Remediation | Vendor-released patch: upgrade IntelliJ IDEA to 2026.2 or later, which remediates the unauthorized file access in Remote Development sessions; refer to the JetBrains fixed-issues advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all developers using IntelliJ Remote Development and restrict feature access to internal networks and trusted IP addresses only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Intellij Idea
View allUnauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration with
Authentication bypass via unauthorized input injection in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers
Code execution via path traversal in JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2 lets an attacker abuse improper
Arbitrary code injection in IntelliJ IDEA before version 2026.2 allows remote attackers to execute arbitrary code by con
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin
In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases. Rated
In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartex
In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to s
In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote att
In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin,
Command execution in JetBrains IntelliJ IDEA before 2026.1.1 allows a holder of the low-privileged guest user account to
In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today