EUVD-2026-72511
GHSA-gf9f-9v25-gm42
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with any low-privilege YouTrack account
-
DeliveryEnumerate or guess restricted project identifier
-
ExploitCraft API request targeting restricted project's knowledge base
-
ExecutionServer skips missing authorization check
-
ImpactUnauthorized article written into inaccessible project
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated YouTrack account at any privilege level (PR:L); unauthenticated external attackers cannot exploit this directly. The target instance must be running any YouTrack build prior to 2026.2.18687. The vulnerable code path is the knowledge base article creation endpoint - other project resources are not implicated by this specific missing check. Exploitation is constrained to integrity impact only: an attacker can write unauthorized articles but cannot read restricted project data or crash the service. Multi-tenant or enterprise deployments where project isolation is enforced for confidentiality purposes face the highest practical risk. |
| Impact | The CVSS 6.5 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N accurately reflects the realistic risk: network-accessible, low complexity, but strictly limited to authenticated users. The high integrity impact (I:H) captures the ability to inject unauthorized content into sensitive, project-isolated knowledge bases - a real concern in multi-tenant or enterprise deployments where project boundaries enforce information segregation. There is no confidentiality or availability impact, limiting the blast radius. No CISA KEV listing exists, no public POC has been identified, and EPSS data was not provided in the input. Overall, this is a genuine but moderate-priority finding: meaningful in environments relying on YouTrack project isolation as a data boundary, lower priority where all YouTrack users are equally trusted. |
| Exploit ScenarioDerived | An authenticated YouTrack user with the lowest available account privileges identifies the numeric or string identifier of a project they cannot normally access. They submit a crafted HTTP request to the YouTrack REST API knowledge base article creation endpoint, referencing the restricted project as the target. Because the server-side permission check is absent, the article is accepted and stored in the restricted project, allowing the attacker to pollute that project's knowledge base with misleading, malicious, or sensitive-appearing content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 07, 2026
Missing server-side permission checks in JetBrains YouTrack before 2026.2.18687 allow any authenticated user to create knowledge base articles inside projects they are not authorized to access. The flaw is rooted in CWE-862 (Missing Authorization), where the article-creation endpoint omits the necessary access control validation against the caller's project permissions. No public exploit or active exploitation has been identified; the CVSS PR:L metric confirms exploitation is limited to users who already hold a valid YouTrack account.
RemediationAI
Upgrade JetBrains YouTrack to version 2026.2.18687 or later, which resolves the missing permission check. The vendor-confirmed fix is documented at https://www.jetbrains.com/privacy-security/issues-fixed/. For self-hosted instances, apply the update through the JetBrains Toolbox or the built-in upgrade mechanism. As an interim compensating control prior to patching, restrict YouTrack access to a trusted, minimal set of internal users by disabling self-registration and auditing guest or low-privilege accounts. Administrators should also review existing knowledge base articles in sensitive projects for any unauthorized content that may have been injected prior to patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetBrains YouTrack is a proprietary, web-based project management and issue-tracking platform widely used in software development organizations. Its knowledge base feature allows teams to document project information scoped to specific projects, with access governed by YouTrack's role-based permission model. The vulnerability, classified as CWE-862 (Missing Authorization), indicates the server-side handler for article creation does not perform an authorization check to verify the requesting user holds a permission grant (e.g., 'Update Project') on the target project. All versions covered by CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* up to build 2026.2.18687 are affected.
Know when Youtrack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible API requires low-privileged authentication; integrity-only impact as unauthorized articles can be written but no data is read or service disrupted.
Primary rating from Vendor (JetBrains).
CVSS VectorVendor: JetBrains
Lifecycle Timeline
1DescriptionCVE.org
In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an auth
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notifi
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Exploit-DB