CVE-2026-103491 in YouTrack
Summary
by MITRE • 10/01/2026
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified as an Insecure Direct Object Reference (IDOR) within JetBrains YouTrack prior to version 2026.2.19422 represents a critical authentication and authorization flaw embedded within the application's core data retrieval mechanisms. This specific weakness resides in the issue activities API, which is designed to fetch historical logs, comments, and status changes associated with individual project issues. The fundamental technical error stems from the server-side logic failing to adequately validate whether the authenticated user possesses the necessary permissions for the specific resource being requested via its unique identifier. Instead of enforcing access control policies based on the relationship between the user's role or group membership and the target issue, the API relies primarily on the presence of a valid session token and the structural validity of the provided object ID. This architectural oversight allows an attacker to manipulate the input parameters by sequentially iterating through integer-based identifiers associated with issues within their accessible projects or potentially across other projects if project-level isolation is also compromised.
From a technical perspective, this vulnerability exploits the predictable nature of database primary keys often used in RESTful APIs. When a client requests activity data for issue ID one hundred, the server retrieves and returns all associated metadata without verifying that the requesting user has read access to that specific item or its parent project. This behavior violates the principle of least privilege and fails to implement proper object-level authorization checks. The flaw is particularly dangerous because it does not require complex exploitation techniques such as buffer overflows or code injection; rather, it leverages standard HTTP GET requests with modified parameters. An attacker who has valid credentials for a low-privileged user account can systematically enumerate issue identifiers by observing successful responses versus forbidden errors, thereby mapping out the existence of sensitive issues that should remain hidden from their view.
The operational impact of this vulnerability is severe, leading to unauthorized disclosure of confidential project information and intellectual property. Since YouTrack serves as a central hub for software development teams, it contains detailed descriptions of bugs, feature requests, security patches in progress, and internal architectural decisions. By exploiting the IDOR flaw, an adversary can extract comprehensive activity logs that reveal not only the content of restricted issues but also metadata such as timestamps, author identities, and resolution statuses. This information leakage facilitates further reconnaissance efforts, allowing attackers to identify high-value targets within the organization's development pipeline or uncover sensitive security-related discussions before patches are deployed. In environments where multiple teams work on shared instances with varying levels of access control, this flaw effectively nullifies those controls for any issue whose identifier can be guessed or enumerated.
To mitigate this vulnerability and prevent similar occurrences in future releases, JetBrains implemented strict server-side validation that cross-references the requested resource ID against the user's explicit permission set before returning data. Organizations running affected versions must immediately upgrade to version 2026.2.19422 or later to patch this security gap. In addition to upgrading, administrators should review their instance configurations to ensure that API access is restricted to trusted networks and that multi-factor authentication is enforced for all user accounts. Regular auditing of API usage patterns can also help detect potential enumeration attacks in real-time. This incident underscores the importance of implementing robust authorization checks at every endpoint level, ensuring that identity verification is always coupled with rigorous permission validation against specific resource ownership or access rights.
This vulnerability aligns directly with CWE-639, which categorizes issues related to Authorization Bypass Through User-Controlled Key. It also maps to MITRE ATT&CK technique T1078, specifically the Valid Accounts subcategory, as it relies on legitimate credentials being misused due to insufficient access control mechanisms rather than credential theft or compromise. The exploitation method resembles automated enumeration strategies often seen in data scraping attacks where attackers iterate through resource IDs to harvest sensitive information systematically. By addressing these authorization gaps, development teams can significantly reduce their attack surface and maintain the integrity of their project management workflows against internal threats and external actors who have gained initial footholds within the network perimeter.