CVE-2026-100264 in YouTrack
Summary
by MITRE • 09/30/2026
In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.18991 represents a critical information disclosure flaw within the application's email notification configuration subsystem. This issue stems from improper handling of sensitive credential data during the process of modifying SMTP server settings. Specifically, when an administrator or user with appropriate privileges attempts to change the host address of the configured SMTP server, the system fails to properly mask or sanitize the stored credentials in its response payload. Instead of returning a sanitized version where passwords are obscured by asterisks or null values as expected for security best practices, the application inadvertently exposes the plaintext password associated with that account. This behavior allows any authenticated user who can access and modify these settings to retrieve sensitive authentication details intended only for internal service-to-service communication between YouTrack and external mail servers.
From a technical perspective, this flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The root cause lies in the backend logic that processes configuration updates. When the host parameter is updated, the serialization process for returning the current state of the SMTP settings does not apply consistent masking rules across all fields or fails to clear cached credential values before sending them back to the client interface. This results in a situation where the API response contains the full plaintext password alongside other non-sensitive configuration details such as port numbers and server addresses. The vulnerability is particularly dangerous because it requires no complex exploitation chain; simply navigating to the email settings page and modifying the host field triggers the disclosure, making it easily reproducible by any user with access to these administrative controls.
The operational impact of this vulnerability extends beyond simple credential theft. Since SMTP credentials are often reused or follow predictable patterns within an organization's infrastructure, exposing them can lead to broader security compromises. Attackers who obtain these credentials may use them to send phishing emails that appear to originate from the legitimate YouTrack system, thereby bypassing email authentication mechanisms like SPF and DKIM which rely on the sending server being trusted. This significantly increases the success rate of social engineering attacks against employees. Furthermore, if the SMTP account has broader permissions or is linked to other services through credential reuse, attackers could potentially gain unauthorized access to additional systems within the network perimeter. The exposure also violates data protection principles and compliance requirements such as GDPR or HIPAA, depending on the nature of the ticketing data managed by YouTrack, due to the mishandling of sensitive authentication material.
Mitigation strategies for this vulnerability are primarily focused on immediate patching and configuration hardening. Organizations running affected versions of JetBrains YouTrack must upgrade immediately to version 2026.2.18991 or later, where the developers have corrected the serialization logic to ensure that password fields are consistently masked in all API responses regardless of other parameter changes. In addition to patching, administrators should enforce strict access controls on email configuration settings, limiting modification rights to a minimal set of senior system administrators rather than granting broad permissions to project leads or regular users. It is also advisable to rotate the SMTP account passwords immediately after upgrading, as there is no guarantee that previous exposures have not already been captured by malicious actors monitoring network traffic or exploiting this flaw in production environments. Regular audits of user privileges and review of API response structures can help detect similar misconfigurations before they are exploited.