EUVD-2026-90017
GHSA-3c9g-jqwf-qrr8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach YouTrack scripts debugger endpoint
-
DeliveryBypass authorisation check
-
ExploitInject malicious script
-
ExecutionExecute arbitrary code on server
-
ImpactFull server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the YouTrack scripts debugger component on instances running versions prior to 2026.2.19197; the flaw is an authorisation bypass (CWE-863) in that specific debugger feature. The CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required, but because the affected component is an administrative scripting/debugger feature, realistic exposure depends on whether that endpoint is network-accessible in a given deployment - instances behind authentication proxies, restricted network segments, or with the debugger disabled face materially lower risk. Limiting factors: single vendor product, patch already available, and no observed exploitation (SSVC Exploitation: none). |
| Impact | Signals are largely aligned toward high severity but diverge on real-world urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes an unauthenticated, network-reachable, low-complexity authorisation bypass yielding arbitrary code execution - the worst-case profile on paper. SSVC agrees on Technical Impact: total, but critically rates Exploitation: none and Automatable: no, meaning CISA's framework sees no observed exploitation and does not consider this reliably scalable. This is corroborated by the absence of a KEV listing and a low EPSS of 0.36% (28th percentile), so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical read: this is a genuine priority to patch given the RCE impact and network exposure of a collaboration server, but it is currently a 'high-CVSS, not-yet-exploited' issue rather than an active emergency. One caveat: although CVSS marks PR:N, the flaw lies in the scripts debugger (an administrative/developer feature), so whether the debugger endpoint is reachable pre-authentication in default deployments is not independently confirmed from the terse description - verify with the JetBrains advisory. |
| Exploit ScenarioDerived | An attacker with network access to a YouTrack instance (versions before 2026.2.19197) reaches the scripts debugger and leverages the authorisation bypass to run arbitrary code in the context of the YouTrack server, without needing valid credentials per the CVSS vector. This grants full control over the issue-tracking server and its data. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 02, 2026
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an authorisation bypass in the scripts debugger, a CVSS 3.1 9.8 flaw (PR:N/UI:N, scope unchanged, confidentiality/integrity/availability all High). Real-world urgency is low despite the score: EPSS is 0.36% (28th percentile), no public exploit code has been identified at time of analysis, CISA SSVC reports Exploitation: none, and there is no KEV listing. Exposure depends on deployment - the debugger endpoint being unreachable, behind an authenticating proxy, or disabled materially lowers risk - and a vendor fix is available in 2026.2.19197.
Earlier versions of this analysis (1)
Authenticated low-privilege users can bypass authorization in JetBrains YouTrack's scripts debugger to execute arbitrary code on servers running versions before 2026.2.19197. This authorization bypass (CWE-863) has a CVSS score of 8.2 and requires network access with high attack complexity, but no user interaction. No public exploit code or active exploitation has been identified at the time of analysis.
RemediationAI
Upgrade JetBrains YouTrack to 2026.2.19197 or later - the vendor has released the fix, and affected-version data confirms everything below 2026.2.19197 is vulnerable; see the vendor fixed-issues advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ and NVD https://nvd.nist.gov/vuln/detail/CVE-2026-100273 for CVE-specific detail. If immediate upgrade is not possible, reduce exposure to the scripts debugger endpoint: block external access at the firewall or reverse proxy, place the debugger behind an authenticating proxy or VPN restricted to trusted administrators, and where the feature is not needed, disable the scripts debugger entirely (trade-off: disables legitimate script debugging and test workflows). Because the flaw is an authorisation bypass rather than an injection primitive, disabling the debugger feature or blocking its routes is the most reliable short-term control; restricting the endpoint helps only if the vulnerable component truly requires that reachability. There is no public exploit identified at time of analysis, but the critical severity and the availability of a patch argue for prompt remediation, and YouTrack server logs should be monitored for unexpected script execution or access to debugger routes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetBrains YouTrack is a proprietary issue-tracking and project-management platform typically deployed as a Java web application; the affected CPE (cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*) covers all releases before 2026.2.19197 per EUVD (YouTrack 0 <2026.2.19197). The root cause is CWE-863 (Incorrect Authorization): access-control checks on the scripts debugger - an administrative component used to test workflow and automation scripts - are missing or incorrectly enforced, so an unauthenticated caller reaching that endpoint can trigger script execution and run arbitrary code in the server context. This explains the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U with all three impact metrics High; the vulnerability class is a broken access-control flaw rather than a memory-safety or injection bug, and practical exploitation hinges on the scripts debugger endpoint being network-reachable.
Know when Youtrack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Accepting the vendor vector: network-reachable authorisation bypass needing no privileges or interaction yields code execution with full CIA impact; PR:N retained per vendor despite debugger-feature caveat.
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
Executive ViewAI
JetBrains YouTrack, a project management and issue tracking platform, is affected by a critical unauthenticated remote code execution vulnerability in versions before 2026.2.19197. If exploited, an attacker could compromise the confidentiality, integrity, and availability of the application and its data, impacting teams that rely on YouTrack for sensitive project tracking. Although no public exploit identified at time of analysis and no CISA KEV listing, the critical severity and availability of a vendor patch require immediate remediation, especially for internet-facing instances.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notifi
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Unauthenticated database backup disclosure in JetBrains YouTrack before 2025.3.156085, 2026.1.13913, and 2026.2.18112 al
Exploit-DB