CVE-2026-123300 in JetBrains
Summary
by MITRE • 11/06/2026
In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in JetBrains Hub prior to version 2026.2.52519 represents a critical failure in the application's authorization logic, specifically concerning the management of authentication module configurations. This flaw allows users who possess only read-only permissions for general project or group resources to escalate their privileges and alter fundamental security settings. The core technical issue lies in the insufficient validation of user roles when processing requests related to auth module group mappings. In a properly secured system, any modification to authentication mechanisms should be restricted exclusively to administrators with explicit write access to security configurations. However, due to this oversight, the application fails to distinguish between read-only operations and administrative changes for specific endpoints governing how groups are mapped to different authentication providers.
This lack of proper authorization control enables an attacker or a malicious insider with low-level privileges to modify which user groups are associated with specific authentication modules. By altering these mappings, the affected individual can potentially bypass existing access controls, grant themselves elevated permissions, or disrupt the authentication flow for other users within the organization. The operational impact is severe as it undermines the integrity of the identity and access management framework. If an attacker successfully modifies these mappings, they could redirect administrative accounts to a compromised authentication provider or remove critical security groups from protected resources, effectively neutralizing organizational security policies without detection by standard audit logs that might not flag configuration changes initiated by lower-privileged users.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Control, as the system fails to enforce the highest level of privilege when handling sensitive administrative functions. It also relates closely to CWE-862, Missing Authorization, because the application does not verify whether the requesting user has the necessary rights for the specific action being performed on auth module configurations. In terms of offensive security frameworks, this behavior is consistent with MITRE ATT&CK technique T1078, Valid Accounts, where an adversary uses legitimate credentials to gain access and then exploits privilege escalation paths within the application logic to achieve unauthorized administrative control.
To mitigate this risk, organizations running JetBrains Hub versions earlier than 2026.2.52519 must upgrade immediately to the patched release which corrects the authorization checks for auth module group mapping endpoints. Until the update is applied, administrators should strictly limit access to the hub interface and monitor audit logs for any unusual changes in authentication configurations or user role assignments. It is also advisable to implement network-level restrictions if possible, ensuring that only trusted administrative workstations can interact with sensitive management interfaces. Regular security audits focusing on permission boundaries and role-based access control policies will help identify similar misconfigurations across other enterprise applications.