CVE-2026-100268 in YouTrack
Summary
by MITRE • 09/30/2026
In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.19197 represents a significant access control failure within the platform's notification subsystem, specifically affecting users with project administrator privileges. This flaw allows individuals who hold administrative rights over one specific project to inadvertently or intentionally retrieve and view comments originating from entirely separate projects where they possess no such permissions. The core of this issue lies in how YouTrack processes notification templates, which are designed to automate the delivery of updates regarding ticket status changes, assignments, and other activities to relevant stakeholders. These templates often include dynamic fields that pull data directly from the associated work items, including user comments, without sufficiently validating whether the requesting administrator has explicit read access to those specific external projects.
From a technical perspective, this constitutes an Insecure Direct Object Reference (IDOR) vulnerability, categorized under CWE-639 in the Common Weakness Enumeration standards. The application fails to enforce proper authorization checks when rendering notification content for administrators of different contexts. When a project administrator triggers or receives a notification that references data from another project, the backend logic retrieves the comment text based on the ticket identifier without cross-referencing it against an access control list that spans multiple projects. This oversight assumes that administrative privileges within one domain should not grant visibility into others unless explicitly configured, but instead allows lateral movement of information across isolated boundaries due to a lack of strict context validation in the notification rendering engine.
The operational impact of this vulnerability is primarily centered on data leakage and potential privacy violations. Project administrators may gain unauthorized access to sensitive discussions, strategic plans, or confidential customer details contained within comments from other projects. This breach undermines the principle of least privilege by allowing users to see information they are not authorized to view based on their assigned role in a different project context. For organizations utilizing YouTrack for multiple distinct initiatives with strict confidentiality requirements, this flaw could lead to unintended disclosure of proprietary information or personal data, potentially violating internal security policies and external regulatory compliance standards such as GDPR if the comments contain personally identifiable information.
Furthermore, this vulnerability aligns with ATT&CK technique T1530, Data from Cloud Storage Object Misconfiguration, although in this case it is more accurately described as a misconfigured access control within an application layer rather than cloud storage itself. It reflects a broader category of issues where internal APIs or UI components do not properly isolate data scopes between different organizational units or projects defined within the same instance. Attackers who compromise an administrator account for one project could exploit this flaw to gather intelligence from other projects, potentially identifying vulnerabilities in those separate workflows or understanding business logic that is not visible through normal interfaces.
Mitigation strategies involve upgrading JetBrains YouTrack to version 2026.2.19197 or later, where the developers have addressed the authorization checks within the notification template processing logic. Until an upgrade can be performed, administrators should exercise extreme caution when configuring notifications and avoid including sensitive data in comments if possible. Additionally, organizations should review their project isolation settings to ensure that strict boundaries are maintained between projects with different sensitivity levels. Regular audits of user permissions and access logs can help detect any unauthorized attempts to view cross-project data through notification channels or other API endpoints before the patch is applied.