EUVD-2026-90020
GHSA-g6f7-qwx3-3rvr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess YouTrack as guest user
-
DeliveryLocate restricted workflow action
-
ExploitRemove action visibility restriction
-
ExecutionExecute unauthorized workflow action
-
ImpactUnauthorized integrity change to project state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that guest access be enabled on the YouTrack instance and that a workflow action carry a visibility restriction the guest should not bypass; the guest user then removes that restriction and runs the action. The governing precondition and limiting factor is the guest-access configuration - instances with guest access disabled are not exposed. No user interaction by a privileged user is required, impact is limited to integrity of workflow actions (no confidentiality or availability effect per CVSS), and only versions before 2026.2.19197 are affected. Note the tension with the published PR:N vector: 'guest users' implies an enabled guest context rather than fully anonymous access against a default configuration. |
| Impact | Signals are mostly aligned toward a moderate, not urgent, priority. The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores 7.5 on integrity-only impact (C:N/I:H/A:N), reflecting an access-control flaw (CWE-863) rather than a system-compromising RCE. Corroborating signals are low: EPSS is 0.29% (19th percentile), the vulnerability is NOT in CISA KEV, SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', and no public exploit was identified. A notable tension exists between the CVSS vector and the description: the vector asserts PR:N (unauthenticated), but the description specifies 'guest users' and the root cause is improper authorization, meaning exploitation presupposes that guest access is enabled on the YouTrack instance - this is a meaningful limiting condition that the base CVSS vector does not capture. Net: this is a legitimate authorization/access-control bug worth patching on a normal cycle, but the combination of integrity-only impact, SSVC 'partial/none/no', low EPSS, and a guest-access precondition argues against emergency prioritization for instances that do not expose guest access. |
| Exploit ScenarioDerived | On a YouTrack instance (before 2026.2.19197) that has guest access enabled, a guest user navigates to a workflow action that was configured with a visibility restriction and strips that restriction, then invokes the action they should not have been permitted to run. No public exploit code was identified, and the impact is integrity-only (manipulating workflow behavior), with no confidentiality or availability effect per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 02, 2026
Incorrect authorization in JetBrains YouTrack before version 2026.2.19197 allows guest users to strip a workflow action's visibility restriction and then execute that action, altering workflow behavior on the instance. The flaw is network-reachable and rated CVSS 7.5 with a PR:N vector, though practical exposure depends on guest access being enabled on the target instance - a configuration in which the guest context supplies the effective precondition; disabling guest access removes the attack surface entirely. Impact is limited to integrity of workflow actions (no confidentiality or availability effect), there is no public exploit identified at time of analysis, EPSS is low (0.29%, roughly 19th percentile), CISA SSVC records exploitation status as none, and the vendor has released a patch in 2026.2.19197.
Earlier versions of this analysis (1)
JetBrains YouTrack before 2026.2.19197 permits guest users to remove a workflow action's visibility restriction and execute the affected action, an authorization-control failure tracked as CWE-863. The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, base 5.9) describes a network-reachable, no-privileges-required issue with high attack complexity and integrity-only impact, so guests cannot directly read data or degrade availability; instances that disable guest access are not exposed. No public exploit identified at time of analysis, and a vendor patch is available.
RemediationAI
Vendor-released patch: 2026.2.19197 - upgrade JetBrains YouTrack to 2026.2.19197 or later, with details available from the JetBrains fixed-issues page at https://www.jetbrains.com/privacy-security/issues-fixed/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-100276. If immediate upgrade is not possible, the most direct compensating control is to disable guest access on the YouTrack instance, which removes the required precondition for exploitation; the trade-off is that unauthenticated or guest viewers lose any read or comment access configured for them. Administrators should also audit workflow actions for unnecessary visibility restrictions and review which accounts hold guest-level roles, but these are mitigations rather than complete fixes because they depend on configuration discipline and do not correct the underlying authorization check. Note that the CVSS vector is PR:N, yet per the independent assessment only instances with guest access enabled are exposed, so environments where guest access is already off carry substantially reduced risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
YouTrack is JetBrains' issue-tracking and project-management platform, and its workflow engine lets administrators attach visibility restrictions to workflow actions so those rules are only exposed or runnable within defined scopes. CVE-2026-100276 is a CWE-863 (Incorrect Authorization) defect in that access-control path: the code that should verify a principal is permitted to modify a visibility restriction does not do so, letting a guest-level user clear the restriction and trigger the action. Because the weakness is in authorization over workflow metadata rather than in the workflow execution engine itself, the resulting impact is confined to integrity of workflow configuration and behavior (CVSS I:H with no confidentiality or availability impact). The affected CPE is cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* and EUVD-2026-90020 lists affected releases as YouTrack 0 < 2026.2.19197, meaning every build before 2026.2.19197 is in scope. The published vector's PR:N reflects network reachability of the flaw, while the authoritative assessment highlights that the governing prerequisite is an instance with guest access enabled rather than fully anonymous access against a default configuration.
Know when Youtrack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Guest access is a near-anonymous, low-barrier principal so PR:N/AC:L are retained; impact is integrity-only (unauthorized workflow action) with no confidentiality or availability effect.
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
Executive ViewAI
JetBrains YouTrack deployments that allow guest access are exposed to an authorization flaw in versions before 2026.2.19197, where a guest can remove a workflow action's visibility restriction and run it, changing how automated workflows behave across the instance. Only workflow integrity is affected - no data exposure or outage capability - and the flaw is network-reachable and unauthenticated with no public exploit identified at time of analysis, so leadership should treat this as a contained governance and configuration risk rather than an active incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an auth
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notifi
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Exploit-DB