CVE-2026-103496 in YouTrack
Summary
by MITRE • 10/01/2026
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified as an insecure direct object reference (iDOR) within JetBrains YouTrack prior to version 2026.2.19422 represents a critical authentication and authorization failure that compromises the confidentiality of user-specific data. This flaw specifically affects the inbox thread functionality, which is designed to aggregate notifications and updates relevant to individual users based on their permissions and project associations. In this context, an insecure direct object reference occurs when the application uses client-supplied input, such as a numeric identifier or internal database key representing a notification record or thread ID, directly in server-side logic without performing adequate authorization checks against the current user's session privileges. Consequently, if an attacker can predict or enumerate these identifiers, they can bypass access controls intended to restrict visibility of notifications belonging to other users within the same instance.
From a technical perspective, this vulnerability stems from insufficient validation on the backend API endpoints responsible for retrieving inbox data. Instead of verifying that the requesting user has explicit permission to view the specific notification thread identified by the provided object ID, the application relies solely on the presence of a valid session token or authentication cookie. This architectural oversight allows any authenticated user with knowledge of another user's notification IDs to issue requests and receive sensitive information contained within those threads. The impact extends beyond mere data leakage; it can expose internal project discussions, private comments, task assignments, and potentially confidential business logic embedded in the communication history between team members.
The operational impact of this vulnerability is significant for organizations relying on YouTrack for collaborative software development management. Unauthorized access to inbox notifications enables an attacker to perform reconnaissance by understanding the organizational structure, active projects, and internal workflows without triggering obvious security alerts that might accompany more aggressive attacks like SQL injection or cross-site scripting. This passive information gathering can facilitate further targeted attacks, such as social engineering campaigns against specific employees whose activities are revealed through their notification history. Furthermore, in environments where multiple teams share a single YouTrack instance with varying levels of sensitivity, this flaw effectively nullifies the isolation boundaries between different user groups, leading to a breach of data confidentiality and potential compliance violations under regulations like GDPR or HIPAA if sensitive personal or health-related information is inadvertently exposed through project communications.
To mitigate this risk, organizations must immediately upgrade their JetBrains YouTrack instances to version 2026.2.19422 or later, where the underlying authorization logic has been corrected to enforce strict ownership checks on all inbox thread retrieval operations. Until an upgrade can be performed, administrators should consider implementing network-level access controls such as web application firewalls that monitor for anomalous patterns in API requests involving sequential ID enumeration. Additionally, enabling comprehensive audit logging allows security teams to detect and alert on unusual access patterns where a single user account rapidly accesses notification IDs associated with disparate or unrelated projects, which may indicate an ongoing exploitation attempt of this iDOR flaw.
This vulnerability is classified under CWE-639, which covers authorization bypass through manipulation of object references, highlighting the fundamental failure in enforcing proper access control policies at the application layer. In terms of offensive security frameworks, it aligns with MITRE ATT&CK technique T1078, specifically Valid Accounts and potentially T1530 for Data from Information Repositories if exploited to extract large volumes of historical data. The remediation strategy emphasizes the importance of implementing principle of least privilege in API design, ensuring that every request is validated against both authentication status and explicit authorization rules tied to the resource being accessed rather than relying on implicit trust based on session validity alone.