CVE-2026-100266 in JetBrains
Summary
by MITRE • 09/30/2026
In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in JetBrains Hub prior to version 2026.2.52366 represents a critical failure in access control mechanisms, specifically classified under CWE-862 Missing Authorization. This flaw allows authenticated users who possess valid credentials for the application to perform actions that should be restricted to administrative roles or system processes. The core technical issue lies in the server-side validation logic associated with the email notification subsystem. When an authenticated user initiates a request to send an email, the backend service fails to verify whether the requesting entity has the necessary privileges to utilize the platform's trusted sender addresses. This oversight effectively bypasses the intended role-based access control model, granting standard users elevated capabilities that compromise the integrity of the communication channel.
From an operational perspective, this vulnerability enables malicious actors or compromised user accounts to send arbitrary emails originating from domains and addresses configured as trusted within the JetBrains Hub environment. Trusted email addresses are typically whitelisted by internet service providers and corporate spam filters due to their association with legitimate organizational infrastructure. By exploiting this flaw, attackers can craft phishing campaigns that appear highly credible because they originate from a recognized internal domain. This significantly increases the likelihood of recipients trusting the content of these messages, thereby facilitating social engineering attacks such as credential harvesting, malware distribution, or business email compromise scenarios. The ability to send emails without restriction also poses risks for spamming and reputation damage to the organization hosting the JetBrains Hub instance.
The exploitation of this vulnerability aligns with several tactics within the MITRE ATT&CK framework. It primarily relates to T1566 Phishing, specifically the use of spearphishing attachments or links where the sender address is spoofed using a trusted domain due to backend misconfiguration rather than simple header manipulation. Additionally, it touches upon T1078 Valid Accounts, as the attack relies on legitimate authentication credentials that are then abused for unauthorized actions. The lack of proper authorization checks means that any authenticated user can act as an email relay service for malicious purposes, turning a collaborative development tool into a vector for broader organizational compromise.
Mitigation strategies must focus immediately on upgrading to JetBrains Hub version 2026.2.52366 or later, where this access control flaw has been rectified by implementing strict role-based checks before processing email sending requests. In environments where immediate patching is not feasible due to operational constraints, temporary mitigations should include restricting network-level access to the JetBrains Hub instance to only trusted IP ranges and enforcing multi-factor authentication for all user accounts to reduce the risk of credential theft leading to exploitation. Furthermore, organizations should monitor outbound email logs from their mail servers for anomalies originating from the JetBrains Hub server's identity, looking for unexpected volumes or recipients that deviate from normal patterns. Implementing strict Content Security Policies and ensuring that sensitive data is not transmitted through channels susceptible to unauthorized relay can also help limit potential damage while longer-term architectural reviews are conducted to prevent similar authorization bypasses in other services.