CVE-2026-123330 in YouTrack
Summary
by MITRE • 11/06/2026
In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in versions of JetBrains YouTrack prior to the release containing build number 2026.2.19562 represents a critical failure in access control mechanisms, specifically classified under CWE-862: Missing Authorization. This flaw allows users who possess only read-only permissions on specific issues or projects to modify sensitive configuration settings related to issue visibility. In enterprise environments where YouTrack is deployed for project management and bug tracking, such granular permission structures are essential for maintaining data integrity and enforcing security policies across different teams with varying levels of trust and responsibility. The existence of this vulnerability indicates that the application failed to properly validate whether a user had sufficient privileges before processing requests intended to alter state or configuration parameters associated with an issue object.
From a technical perspective, the root cause lies in the server-side logic handling visibility updates for issues. When a client sends a request to change who can view an issue, such as modifying it from public to private or restricting access to specific groups, the backend service did not adequately check if the authenticated user held administrative rights or owner privileges over that particular resource. Instead of enforcing strict role-based access control checks at the point of execution for these configuration changes, the system accepted the input from any authenticated session with basic read capabilities. This oversight effectively bypasses the intended security boundary between standard users and administrators, allowing lower-privileged entities to escalate their influence over data accessibility without gaining full administrative rights or needing to exploit separate privilege escalation vectors.
The operational impact of this vulnerability is significant for organizations relying on YouTrack for sensitive development workflows. By altering issue visibility settings, an attacker with read-only access can potentially expose confidential bug reports, architectural details, or internal project roadmaps to unauthorized parties within the organization. This could lead to information disclosure where proprietary code vulnerabilities are revealed to competitors or external actors if the visibility is set incorrectly. Furthermore, it undermines the principle of least privilege by allowing users to manipulate security configurations beyond their assigned scope. In severe cases, this capability could be leveraged as part of a broader attack chain to disrupt project management workflows, hide malicious activities from auditors by changing issue statuses and visibility simultaneously, or cause confusion among team members regarding which issues are officially tracked versus those that have been obscured.
This type of access control bypass is commonly associated with ATT&CK technique T1078: Valid Accounts, where an attacker uses legitimate credentials to perform actions outside their intended scope. It also aligns with CWE-269: Improper Privilege Management, highlighting the need for rigorous validation of user roles against requested operations. To mitigate this risk, organizations running affected versions must immediately upgrade JetBrains YouTrack to version 2026.2.19562 or later, where the authorization checks have been corrected to ensure that only users with appropriate administrative privileges can modify issue visibility settings. Additionally, administrators should review existing user permissions and audit logs for any suspicious activity that may have occurred while the vulnerability was present in their environment. Implementing strict role-based access controls and regularly auditing permission assignments will further reduce the risk of similar authorization flaws affecting critical business applications.