CVE-2026-111092 in YouTrack
Summary
by MITRE • 10/15/2026
In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in JetBrains YouTrack prior to versions 2026.2.19575, 2026.3.16075, 2026.3.16397, and 2026.3.16402 represents a significant authorization bypass within the application's mail rule processing engine. This flaw specifically impacts users holding project administrator privileges, allowing them to execute commands on issues located in projects other than the one they are authorized to manage. The core of this issue lies in how the system processes incoming emails that trigger automated actions defined by mail rules. When an email matches a configured rule, YouTrack attempts to perform specific operations on associated or referenced issues based on the content and metadata within the message.
The technical flaw stems from insufficient validation of project boundaries during the execution phase of these mail-triggered commands. While the application correctly restricts direct user interface interactions to the scope of assigned projects, the backend logic handling automated rule executions failed to enforce strict isolation between distinct project contexts. A malicious or compromised project administrator could craft an email containing specific keywords, tags, or command syntax that references issues in a different project. Upon receipt and processing by the mail server integration, YouTrack would interpret these directives as valid commands for the referenced issue, effectively bypassing the intended access controls designed to segregate data and operations between separate projects within the same instance.
This vulnerability aligns with CWE-269, Improper Privilege Management, specifically regarding insufficient enforcement of contextual boundaries for elevated privileges. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior is indicative of T1078 Valid Accounts and potentially T1548 Abuse Elevation Control Mechanism if leveraged to escalate influence across organizational silos. The ability to manipulate issues outside one's designated scope undermines the fundamental principle of least privilege that underpins multi-tenant or departmentally segmented project management workflows. It allows a user with legitimate access in one area to exert control, modify status, change assignees, or alter metadata in unrelated areas without triggering standard audit alerts for unauthorized direct access attempts.
The operational impact of this vulnerability is substantial for organizations relying on YouTrack for strict workflow segregation and compliance tracking. Project administrators are often granted broad powers within their specific domain to streamline workflows, but these privileges should not extend beyond those boundaries. An attacker exploiting this flaw could disrupt critical development cycles by altering issue statuses in unrelated projects, potentially causing confusion regarding release readiness or sprint progress. Furthermore, it poses a risk to data integrity and audit trails, as changes made via mail rules may lack the same level of explicit user attribution found in direct UI interactions, complicating forensic analysis after an incident.
Mitigation for this vulnerability requires immediate upgrading to patched versions of JetBrains YouTrack, specifically version 2026.2.19575 or later within the 2026.3 branch (including builds 16075, 16397, and 16402). These updates introduce stricter validation logic that ensures mail rule commands are scoped strictly to issues belonging to the project associated with the user's active context or explicitly authorized cross-project permissions if such features exist in higher-tier configurations. In environments where upgrading is not immediately feasible, administrators should review existing mail rules for any syntax that references external projects and restrict them accordingly. Additionally, enabling comprehensive audit logging for all issue modifications can help detect anomalous activity patterns resulting from unauthorized cross-project manipulations until the patch is applied.