EUVD-2026-90022
GHSA-7p7q-vpq8-mw97
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with restricted YouTrack account
-
ExploitOpen issue with other users' comments
-
ExecutionInvoke edit/hide action bypassing authz check
-
ImpactTamper with or conceal victim comments
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated YouTrack account that has been granted at least some (restricted/limited) permission within a project - the flaw lets such a user act on other users' comments without the proper authorization check. Exploitation is limited by the need for an existing account (no anonymous access) and produces only integrity impact (editing/hiding comments); there is no data disclosure or service disruption. The description's 'restricted permission' phrasing indicates a low-privilege user suffices, which contradicts the vendor's PR:H rating. Applies to all YouTrack versions before 2026.2.19197 in default configuration; no special feature toggle or non-default setting is named. |
| Impact | This is a genuine but low-to-moderate priority authorization flaw, not a high-urgency issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, base 4.9) describes network-reachable, low-complexity exploitation with NO confidentiality or availability impact - the sole impact is integrity (I:H), consistent with CWE-863 (improper authorization) letting a user tamper with data they should not control. There is no EPSS score, no CISA KEV listing, and no public POC provided, so exploitation status is: no public exploit identified at time of analysis. A notable conflict exists in the privileges metric: the description says 'users with restricted permission' (implying a low-privilege account, PR:L), yet the vendor rated it PR:H; if PR:L is correct the base score rises to roughly 5.4. This is a signal worth verifying with JetBrains, but it does not change the fundamental picture - the flaw requires an authenticated account and only permits comment tampering, so real-world risk is bounded. No conflict exists between attack vector and description; both point to authenticated network access. |
| Exploit ScenarioDerived | An authenticated YouTrack user who has been granted only restricted/limited permissions on a project navigates to an issue and, exploiting the missing authorization check, edits or hides comments authored by other users - content they should have no rights to modify. No public exploit code is available, but the low attack complexity (AC:L) and network vector mean any logged-in user with a valid session could trigger it through the normal comment UI or API. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Improper authorization in JetBrains YouTrack before 2026.2.19197 allows an authenticated user with restricted project permissions to edit and hide other users' comments. The flaw is an incorrect authorization check (CWE-863) that yields only integrity impact - no data disclosure or service disruption - and exploitation requires an existing YouTrack account. No public exploit code has been identified at the time of analysis, and a vendor patch is available in version 2026.2.19197.
RemediationAI
Upgrade JetBrains YouTrack to version 2026.2.19197 or later; this is the vendor-released patch that addresses the missing authorization check. For cloud-hosted YouTrack, confirm that JetBrains has applied the corresponding update. If immediate upgrade is not possible, mitigate by minimizing the number of users granted any project-level permissions, since the flaw requires only restricted permissions to exploit; additionally audit comment history and edit logs for unauthorized changes, and monitor for unexpected hides or edits of comments by low-privilege accounts. Be aware that restricting permissions may impede normal collaboration for legitimate users. The official advisory is at https://www.jetbrains.com/privacy-security/issues-fixed/.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an instance of CWE-863, Incorrect Authorization, in JetBrains YouTrack's comment management functionality. YouTrack is a proprietary issue tracker and project management platform; its permission model grants project- and role-scoped rights to authenticated users. According to the vendor, users holding only restricted permissions could perform edit and hide operations on comments authored by other users because the application failed to enforce ownership or elevated-permission checks on those endpoints. The vendor-assigned CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, indicating a network-reachable, high-privilege-required integrity issue; the independent assessment revised the privilege requirement to PR:L (low-privilege authenticated user) based on the described 'restricted permission' scenario, while agreeing that no confidentiality or availability impact is present. The affected CPE is cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* and EUVD lists YouTrack versions 0 through 2026.2.19197 as vulnerable.
Know when Youtrack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Description's 'restricted permission' implies a low-privilege authenticated user (PR:L, not vendor's PR:H); network-reachable comment action is low-complexity; impact is integrity-only comment tampering with no confidentiality or availability effect.
Primary rating from Vendor (JetBrains).
CVSS VectorVendor: JetBrains
Lifecycle Timeline
1DescriptionCVE.org
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an auth
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notifi
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Exploit-DB