EUVD-2026-90003
GHSA-9vmv-xhw6-9wrm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as view-only YouTrack user
-
ExploitAccess shared Gantt chart
-
ExecutionSubmit edit request bypassing authorization check
-
ImpactModify task schedule/dependencies (integrity impact)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated YouTrack user (PR:L) who has been granted view-only access to a Gantt chart; that user can then perform edit actions the access model should forbid. Exploitation is limited by the need for a valid account with at least view permission on the target chart and network reachability to the YouTrack web interface - there is no unauthenticated path and no user-interaction component. Impact is confined to integrity of Gantt/scheduling data (C:N/A:N); versions at or above 2026.2.18991 are not affected. |
| Impact | All signals point to a genuinely low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable but authenticated (PR:L) flaw with only low integrity impact and zero confidentiality or availability impact - the attacker must already be a legitimate, logged-in YouTrack user who has been granted at least view access to a Gantt chart. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so this is 'no public exploit identified at time of analysis.' The CWE-863 (improper authorization) classification is consistent with the description: it is a privilege/permission-boundary weakness (view-only users can edit), not remote code execution or data theft. No SSVC decision data was supplied. The vendor-assigned 4.3 aligns with an independent read - this is a legitimate but minor authorization defect, not a high-CVSS-but-overrated issue nor a hidden critical. Note one taxonomy caveat: the 'Authentication Bypass' tag is imprecise - this is an authorization/access-control failure by an already-authenticated user, not authentication bypass. |
| Exploit ScenarioDerived | A user who has been granted view-only access to a project's Gantt chart in a shared YouTrack instance issues edit operations that the UI/permission model should block, modifying task schedules or dependencies they are only supposed to read. No public exploit code is available; because the flaw requires a valid low-privilege account (PR:L) and network access to the YouTrack web app, realistic abuse is limited to insiders or users of multi-tenant/shared instances. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Improper access control in JetBrains YouTrack before 2026.2.18991 lets an authenticated user who has only view-only permission on a Gantt chart perform edit operations that the access model should block. The flaw is network-reachable but requires a valid YouTrack account (PR:L), has no user-interaction component, and is confined to low-severity integrity impact on scheduling/Gantt data with no confidentiality or availability effect (CVSS 4.3, CWE-863). There is no confirmed active exploitation (CISA KEV not listed) and no public exploit identified at time of analysis; the vendor has released a fixed build in 2026.2.18991.
RemediationAI
Upgrade JetBrains YouTrack to the vendor-released fixed version 2026.2.18991 or later (Vendor-released patch: 2026.2.18991), following the JetBrains fixed-issues advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ for the corresponding release notes. Because the defect is an authorization-enforcement gap that requires an authenticated account with at least view permission on a Gantt chart, the effective interim compensating control is least-privilege restriction: audit and narrow Gantt chart access so that accounts granted only view-only rights are limited to users who should not be able to modify scheduling data, and temporarily withhold Gantt visibility from untrusted or broad user groups; the trade-off is reduced visibility into project timelines for those users and is only a partial mitigation since it removes rather than fixes the underlying write path. Ensuring the YouTrack web interface is not broadly reachable from untrusted networks (network segmentation or reverse-proxy access control) limits the population of authenticated users who can trigger the flaw, at the cost of restricting legitimate remote access. No public exploit code has been identified, so emergency out-of-band change windows are not warranted; a normal patch cycle is appropriate for this low-severity integrity issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is rooted in CWE-863 (Incorrect Authorization) within the Gantt chart component of JetBrains YouTrack, a project-management and issue-tracking platform. Gantt views render timeline/task data and expose write-side operations (task scheduling, drag/resize, dependency or date edits) whose server-side authorization checks evidently validate only that the caller can view the chart rather than that the caller holds edit rights on the underlying project/issue entities. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, the vulnerable surface is the network-exposed web interface, exploitation is low-complexity and needs no user interaction, and the authorization gap permits a low-privilege authenticated principal to cross a read/write boundary - but only within the scope of the affected chart, yielding limited integrity impact and no confidentiality or availability impact. The CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* indicates a wildcard version match, and EUVD records the affected range as YouTrack 0 through (but not including) 2026.2.18991, with all builds at or above 2026.2.18991 unaffected.
Know when Youtrack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Authenticated low-privilege user (PR:L) over the network exploits a missing authorization check with low complexity; only low integrity impact, no confidentiality or availability effect.
Primary rating from Vendor (JetBrains).
CVSS VectorVendor: JetBrains
Lifecycle Timeline
1DescriptionCVE.org
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an auth
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notifi
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Exploit-DB