CVE-2026-123327 in YouTrack
Summary
by MITRE • 11/06/2026
In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in versions of JetBrains YouTrack prior to build 2026.2.19562 represents a critical failure in access control mechanisms within the application's saved query functionality. This flaw, classified under CWE-862 as Missing Authorization, allows unauthenticated or unauthorized users to bypass intended security restrictions and retrieve sensitive data that should be restricted based on user roles and permissions. The core of the issue lies in how the backend handles requests directed at endpoints responsible for retrieving previously saved queries. In a properly secured system, every request to access such resources must undergo rigorous validation against the current session's authentication token and associated permission sets. However, due to this implementation defect, the server fails to verify whether the requesting user has explicit rights to view the specific query or its underlying data context.
From a technical perspective, the vulnerability exploits the lack of object-level authorization checks on the saved query retrieval API. When an attacker constructs a request targeting a known identifier for a saved query belonging to another user or a restricted project, the application processes this request without confirming that the requester is authorized to see it. This oversight enables the disclosure of issue descriptions and potentially other metadata associated with those issues. The impact extends beyond simple data leakage; because YouTrack is often used as a central hub for tracking software defects, feature requests, and operational incidents, exposing these details can reveal internal development workflows, known security bugs in progress, or architectural weaknesses that are not yet publicly disclosed. This information could be leveraged by malicious actors to plan targeted attacks against the organization's infrastructure or intellectual property.
The operational impact of this vulnerability is significant for organizations relying on YouTrack for project management and issue tracking. Disclosure of issue descriptions can lead to a breach of confidentiality, violating data protection policies and potentially regulatory requirements such as GDPR if personal data is contained within those issues. Furthermore, attackers may use the exposed information to perform social engineering attacks or to refine their understanding of the target's security posture. For example, knowing that a specific critical vulnerability is being tracked internally but not yet patched provides a clear window for exploitation before remediation efforts are completed. This transforms a simple data leak into a strategic advantage for adversaries seeking to compromise systems during periods of known vulnerability awareness within the victim organization.
Mitigation strategies primarily involve upgrading to JetBrains YouTrack version 2026.2.19562 or later, where this authorization check has been properly implemented and validated. For organizations unable to upgrade immediately due to operational constraints, it is advisable to restrict access to the affected endpoints through network-level controls if possible, although this is often difficult in cloud-hosted SaaS environments. Administrators should also audit their instance for any signs of unauthorized data exfiltration by reviewing API request logs for unusual patterns targeting saved query resources. Additionally, enforcing strict role-based access control policies and regularly auditing user permissions can help minimize the blast radius if similar vulnerabilities are discovered in other parts of the application. Continuous monitoring and adherence to security best practices outlined in industry standards like MITRE ATT&CK technique T1078, which covers valid accounts being used for unauthorized access, remain essential components of a robust defense-in-depth strategy against such authorization bypass flaws.