CVE-2026-100261 in YouTrack
Summary
by MITRE • 09/30/2026
In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.18991 represents a critical access control failure within the application's content management subsystem. Specifically, the flaw allows users who lack explicit write or administrative permissions for an article to modify its visibility settings. In enterprise environments utilizing YouTrack for issue tracking and documentation, articles often contain sensitive project details, architectural decisions, or confidential bug reports that are intended for restricted audiences. The ability to alter these visibility parameters without proper authorization undermines the fundamental principle of least privilege, enabling unauthorized users to potentially expose private information to a broader audience than originally intended by the content owner or system administrator.
From a technical perspective, this issue stems from an insufficient verification mechanism in the backend logic handling article metadata updates. When a user submits a request to change the visibility status of an article, such as switching it from public to internal-only or vice versa, the server fails to adequately validate whether the requesting user possesses the necessary update permissions for that specific resource. This oversight likely involves a missing check against the access control list associated with the target entity before processing the state transition. Consequently, any authenticated user can manipulate these settings regardless of their role-based restrictions, effectively bypassing the intended security boundaries established by the organization's permission schema.
The operational impact of this vulnerability is significant for organizations relying on YouTrack as a central hub for project management and knowledge sharing. By altering visibility settings without authorization, an attacker or malicious insider could escalate information disclosure risks. For instance, they might change private articles to public status, thereby leaking proprietary code snippets, security vulnerabilities under investigation, or strategic business plans to external parties or unauthorized internal teams. Conversely, changing visible articles to hidden states could disrupt workflow continuity by preventing legitimate stakeholders from accessing critical documentation required for ongoing tasks. This dual nature of the flaw affects both confidentiality and availability aspects of the information system's integrity.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it involves a failure to enforce proper access controls on specific functions or resources. Furthermore, in the context of the MITRE ATT&CK framework, this behavior is consistent with techniques related to Defense Evasion and Data Exfiltration via permission manipulation. Attackers often exploit such flaws to expand their footprint within an application without needing higher-level credentials initially. The lack of strict validation on metadata modification endpoints allows for lateral movement in terms of data access rights, potentially leading to more severe compromises if combined with other vulnerabilities or social engineering tactics aimed at further privilege escalation.
To mitigate this risk, organizations running affected versions of JetBrains YouTrack must immediately upgrade to version 2026.2.18991 or later, where the permission checks have been corrected to ensure that only users with explicit update rights can modify article visibility settings. In addition to applying the patch, administrators should review existing user roles and permissions within their instance to identify any accounts that may have been exploited during the window of vulnerability. Implementing robust audit logging for metadata changes is also recommended to detect unauthorized attempts in real-time. Regular security assessments focusing on access control logic across all content management modules will help prevent similar flaws from being introduced or overlooked in future updates, ensuring a more resilient posture against internal and external threats targeting data confidentiality.