CVE-2026-100272 in YouTrack
Summary
by MITRE • 09/30/2026
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.19197 represents a critical failure in access control mechanisms within the application's notification system. Specifically, this flaw resides in the functionality that allows users to preview email or message templates used for automated notifications. In a properly secured enterprise issue tracking environment, such as YouTrack, strict role-based access controls are essential to ensure that sensitive project data remains confined to authorized personnel only. The architecture of YouTrack relies on distinct permission levels where Project Administrators hold elevated privileges compared to standard users, yet these privileges must still be bounded by the specific scope of issues they are permitted to view based on their assigned roles and group memberships within a given project.
The technical root cause of this vulnerability is an insufficient authorization check during the execution of the notification template preview endpoint or feature. When a Project Administrator initiates a preview for a notification template, the system processes variables embedded within that template which may reference specific issue identifiers or data fields to demonstrate how the final message will appear. However, the backend logic responsible for resolving these references fails to validate whether the requesting user has explicit read access to the underlying issues being referenced in the preview context. This oversight allows an authenticated Project Administrator to supply arbitrary issue IDs within a template variable and trigger the rendering engine without the system verifying if those specific issues are part of the administrator's authorized view scope. Consequently, the application returns detailed information about restricted or private issues that should otherwise be invisible to this user role.
The operational impact of this vulnerability is significant for organizations relying on YouTrack for sensitive project management workflows. Project Administrators can exploit this flaw to enumerate and read content from issues marked as private, confidential, or belonging to other projects where they do not hold administrative rights. This constitutes a direct violation of data confidentiality principles and could lead to the exposure of proprietary code snippets, strategic business plans, customer personal information, or security-related bug reports that were intentionally shielded from broader access. In scenarios involving compliance-driven industries such as finance or healthcare, this unauthorized disclosure may also result in violations of regulatory frameworks like GDPR or HIPAA due to the inadvertent leakage of protected data through a seemingly benign administrative feature.
From a classification perspective, this vulnerability aligns with CWE-285 Improper Authorization, which describes situations where an application does not properly verify that a user has permission to perform a requested action on a specific resource. Furthermore, in the context of the MITRE ATT&CK framework, this behavior is indicative of techniques associated with Discovery and potentially Data Exfiltration via Application Layer Protocol, as it allows an insider threat actor or compromised account to gather intelligence about restricted assets within the organization's infrastructure. The flaw highlights the importance of implementing consistent authorization checks not only for primary data retrieval endpoints but also for auxiliary features like template previews that indirectly access underlying resources through variable substitution mechanisms.
To mitigate this vulnerability and prevent further exploitation, organizations must immediately upgrade their JetBrains YouTrack instances to version 2026.2.19197 or any later release where the authorization logic has been corrected. This patch ensures that when a notification template is previewed, the system rigorously validates the requesting user's permissions against every issue ID resolved from the template variables before rendering the output. Until an upgrade can be performed in controlled maintenance windows, administrators should restrict access to the notification configuration interface to only those users who absolutely require it for operational purposes. Additionally, implementing strict logging and monitoring on administrative actions related to template modifications and previews can help detect any anomalous attempts to enumerate restricted issues through this vector, providing a layer of defense-in-depth while technical remediation is being applied.