CVE-2026-100269 in YouTrack
Summary
by MITRE • 09/30/2026
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.19197 represents a critical access control failure within the platform's reporting mechanism, specifically affecting projects configured with Help Desk functionality. In enterprise environments, YouTrack is frequently utilized not only for standard software development tracking but also as an internal IT service management tool where strict boundaries between user roles are essential to maintain operational integrity and data confidentiality. The core of this issue lies in the improper enforcement of authorization checks on the Authorized Reporters list associated with Help Desk projects. This list serves as a whitelist, defining which users or groups possess the privilege to submit tickets for specific services or categories within the helpdesk workflow. When these restrictions are bypassed, it effectively nullifies the intended segregation of duties and access controls established by system administrators.
From a technical perspective, this flaw constitutes an authorization vulnerability where the application fails to properly verify whether the authenticated user is included in the designated list before allowing them to create or modify tickets within that specific context. This type of defect aligns with CWE-285 Improper Authorization, as the software does not enforce appropriate access control levels for authorized users against unauthorized actors. The bypass likely stems from a logic error in how the backend processes requests related to ticket creation, potentially failing to cross-reference the user's identity or group memberships against the project-specific configuration settings before accepting input. This allows any authenticated user who has general access to YouTrack to circumvent the specific restrictions placed on Help Desk projects, effectively granting them privileges they were not intended to have within that scope.
The operational impact of this vulnerability is significant for organizations relying on YouTrack for IT service management or customer support workflows. By bypassing the Authorized Reporters list, an attacker can submit tickets under categories or services restricted to specific teams such as HR, Finance, or senior engineering staff. This can lead to several adverse outcomes including information disclosure if sensitive ticket details are visible during submission, privilege escalation within the application's workflow logic, and potential disruption of service operations through unauthorized changes to high-priority issues. Furthermore, it undermines audit trails and compliance reporting since actions taken by unauthorized users may be attributed incorrectly or bypass monitoring mechanisms designed for specific user groups. In regulated industries where adherence to standards like ISO 27001 regarding access control is mandatory, such a flaw could result in non-compliance findings during security audits.
To mitigate this risk, organizations must immediately upgrade their JetBrains YouTrack instances to version 2026.2.19197 or later, where the authorization logic has been corrected to properly enforce the Authorized Reporters list constraints. Until an upgrade is feasible, administrators should review project configurations and consider restricting broader access to Help Desk projects if possible, although this may impact overall usability. It is also advisable to monitor logs for unusual ticket creation patterns that deviate from established user behavior profiles. From a defensive posture perspective, implementing network-level controls such as web application firewalls can provide an additional layer of inspection, though they are not a substitute for patching the underlying code flaw. The vulnerability maps to MITRE ATT&CK technique T1078 Valid Accounts, where adversaries leverage legitimate credentials to bypass security restrictions and gain unauthorized access to resources within the environment.