EUVD-2026-90581
GHSA-9xfx-g95j-mffp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as high-privilege user
-
DeliveryAccess user group link functionality
-
ExploitAbuse missing authorization check
-
ExecutionEscalate group membership/privileges
-
ImpactGain administrative control over YouTrack
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated, already-high-privilege YouTrack account (CVSS PR:H) on a version before 2026.2.19422; the attacker abuses the 'user group links' functionality where an authorization check is missing (CWE-862) to escalate privileges. No user interaction is needed (UI:N) and it is reachable over the network (AV:N) with low attack complexity (AC:L). The key limiting factor is the PR:H prerequisite: a fully unprivileged or anonymous attacker cannot exploit this, so exposure is bounded to deployments that issue high-privilege-but-non-admin accounts to semi-trusted users. |
| Impact | Signals point to a real-but-gated issue rather than an urgent fire-drill. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2) reports full confidentiality, integrity, and availability impact, but critically requires PR:H - the attacker must already hold a high-privilege YouTrack account before escalating further via user group links, so this is an insider/post-compromise privilege-escalation path, not a pre-auth network takeover. No EPSS score is provided, this is not in CISA KEV, and no public proof-of-concept is referenced (only a JetBrains issues-fixed landing page), so exploitation status is: no public exploit identified at time of analysis. SSVC inputs (exploitation, automatable, technical impact) were not supplied. The PR:H prerequisite is the single biggest risk-dampener: raw severity is HIGH, but realistic risk is moderate and confined to environments where lower-trust 'high-privilege-but-not-admin' accounts exist. Note a labeling conflict: the CWE is CWE-862 (missing authorization) and the vuln is privilege escalation, yet the input tags it 'Authentication Bypass' - these are distinct and the tag appears incorrect. |
| Exploit ScenarioDerived | An attacker who already controls a privileged (but non-administrator) YouTrack account manipulates user group links to grant themselves membership or rights they should not have, escalating to broader administrative control over projects and data. No user interaction is needed and the attack is over the network against the authenticated application. No public exploit code is referenced, so exploitation would currently require independent research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Privilege escalation in JetBrains YouTrack lets an authenticated holder of an already-high-privilege (non-admin) account raise their effective permissions by abusing the user group links functionality, where a required authorization check is missing (CWE-862). All YouTrack releases before 2026.2.19422 are affected, and the issue is scored CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact once triggered, requiring no user interaction. The PR:H prerequisite meaningfully bounds exposure - anonymous or fully unprivileged users cannot exploit it - and there is no public exploit identified at time of analysis, making this a real but gated finding rather than an urgent fire-drill.
RemediationAI
The primary fix is to upgrade YouTrack to 2026.2.19422 or later, the version in which JetBrains resolved the missing authorization check; the consolidated vendor advisory listing is at https://www.jetbrains.com/privacy-security/issues-fixed/. Operators of JetBrains-hosted YouTrack instances should confirm with the vendor that their tenant has been moved to the fixed build, since they cannot patch it themselves. Where an immediate upgrade is not feasible, the effective compensating control is minimizing the population of high-privilege non-admin accounts (CVSS PR:H means only such accounts can exploit this), tightening which users receive elevated roles on projects, and reviewing existing user group links for unexpected grants - the trade-off being added administrative overhead and possible workflow friction for users who legitimately need elevated access. Note that restricting network access does not help much here because the vector is AV:N with PR:H, so the account-level prerequisite, not perimeter filtering, is the real choke point. Because no public exploit code has been identified, there is no evidence pointing to urgent emergency change management, but the fix should still be scheduled promptly given the high C/I/A impact of successful escalation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
YouTrack is JetBrains' web-based issue tracker and project management platform, whose permission model is built around users, groups, roles, and the links that bind groups to projects and roles. CVE-2026-103490 is rooted in CWE-862 (Missing Authorization): an authorization check that should gate the manipulation of user group links is absent, so a caller who already holds a high-privilege account can create or alter those links to obtain permissions beyond what was granted. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H indicates the attack is network-reachable with low complexity, needs no user interaction, affects only the vulnerable component's security scope, and yields high impact to confidentiality, integrity, and availability - but the PR:H value confirms the attacker must already be authenticated with elevated privileges. The affected CPE, cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*, uses a wildcard version, consistent with a vendor advisory covering every YouTrack build prior to 2026.2.19422 rather than a single named release.
Know when Youtrack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable app with low complexity and no UI, but attacker must already hold a high-privilege account (PR:H); successful escalation yields full admin-level C/I/A within the same system (S:U).
Primary rating from Vendor (JetBrains).
CVSS VectorVendor: JetBrains
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
Executive ViewAI
JetBrains YouTrack, the issue-tracking platform that holds engineering, support, and product workflows, contains a privilege-escalation flaw (CVE-2026-103490) allowing an authenticated user who already holds elevated non-admin rights to raise their effective permissions, potentially reaching full administrative control of the instance. Every release before 2026.2.19422 is affected and no vendor patch is currently available, so any self-managed deployment carries a standing exposure to its system of record. Leadership should care because successful exploitation yields complete read, modify, and delete access to all tracked projects, issues, and any credentials or sensitive notes stored in the tool, even though the requirement for an existing high-privilege account bounds who can trigger it.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict creation and modification of user group links to the smallest possible set of trusted administrators; reduce standing elevated non-admin privileges; enable and alert on YouTrack audit logs for permission and group-membership changes; limit network access to administrative and group-management interfaces via VPN, jump host, or allowlist; require MFA for all accounts; and pursue a hotfix or a build at or above 2026.2.19422 directly with JetBrains.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an auth
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing ac
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notifi
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains
A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Exploit-DB