CVE-2026-100276 in YouTrack
Summary
by MITRE • 09/30/2026
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.19197 represents a critical authorization flaw that allows unauthenticated or low-privilege guests to bypass administrative security controls within the application's workflow engine. This issue stems from an improper implementation of access control checks when processing requests related to workflow action configurations. Specifically, the system fails to adequately verify whether the requesting user possesses the necessary permissions to modify visibility restrictions on existing workflow actions. In a properly secured environment, only users with explicit administrative rights or designated workflow management privileges should be able to alter how and where specific automated actions are visible or executable within the project structure. The absence of these rigorous checks enables guest accounts, which typically have read-only access by default in many configurations, to escalate their privileges effectively through manipulation of API endpoints or web interface requests associated with workflow metadata updates.
From a technical perspective, this flaw aligns closely with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization. The core mechanism involves the application accepting state-changing HTTP requests without validating that the session token corresponds to an account authorized for such modifications. When a guest user submits a request to remove visibility restrictions from a workflow action, the backend logic processes this change as valid because it does not cross-reference the current permission scope against the required privilege level for configuration changes. This oversight allows the attacker to transform restricted actions into publicly accessible ones or execute them in contexts where they were previously blocked by design. The vulnerability exploits the trust placed in the client-side interface and server-side routing logic, assuming that UI-level restrictions are sufficient without enforcing equivalent checks at the API layer.
The operational impact of this vulnerability is significant for organizations relying on YouTrack for issue tracking and project management workflows. By removing visibility restrictions or executing restricted actions, an attacker can disrupt automated processes designed to enforce business rules, such as mandatory field validation, status transitions, or notification triggers. This disruption can lead to data integrity issues where tickets are moved through stages without proper approval or documentation. Furthermore, the ability to execute arbitrary workflow actions may allow for further exploitation within the system, potentially leading to unauthorized access to sensitive project information or manipulation of ticket states in ways that bypass audit trails. In environments where YouTrack is integrated with other tools via webhooks triggered by these workflows, this could also facilitate broader supply chain attacks if those downstream systems trust inputs from compromised workflow executions without independent verification.
Mitigation strategies must prioritize immediate patching to the latest stable release version 2026.2.19197 or later, where JetBrains has addressed the authorization logic flaws in the workflow management subsystem. For organizations unable to upgrade immediately due to compatibility constraints with custom plugins or integrations, temporary mitigations should include restricting guest access entirely if not strictly required for public-facing issue reporting features. Administrators can also implement network-level controls such as Web Application Firewalls configured to detect and block anomalous patterns in API requests targeting workflow configuration endpoints. Additionally, enabling comprehensive audit logging focused on changes to workflow definitions will aid in detecting any attempted exploitation activities post-deployment. Regular security assessments should include testing for broken access control vulnerabilities using methodologies aligned with the OWASP Testing Guide and ATT&CK techniques related to privilege escalation and unauthorized resource modification to ensure that similar gaps do not exist elsewhere in the application architecture.