CVE-2026-123333 in YouTrack
Summary
by MITRE • 11/06/2026
In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/06/2026
A critical authorization bypass vulnerability exists in versions of JetBrains YouTrack prior to version 2026.2.19562, specifically affecting the functionality related to sprint management and issue lifecycle operations. The core technical flaw lies within the backend logic that handles requests for moving issues between sprints during their creation or modification phases. When a user initiates an action to move one or more issues into a newly created or existing sprint, the system fails to perform adequate access control checks on the source projects of those specific issues. This oversight allows authenticated users who possess valid permissions within certain accessible projects to manipulate and reassign issues that reside in completely separate, inaccessible projects for which they have no read or write privileges. The vulnerability effectively decouples the permission model from the operational context of sprint management, treating all referenced issue identifiers as mutable regardless of their underlying project security boundaries.
From a technical perspective, this represents a classic Broken Access Control scenario where the application logic assumes that if a user can interact with the sprint container, they implicitly have rights to modify any item placed within it. The system likely validates the target sprint's permissions but neglects to iterate through and verify the access levels for each individual issue ID provided in the request payload against its associated project’s security group or role-based access control list. This lack of granular verification enables an attacker with low-privileged credentials to perform unauthorized data manipulation, effectively bypassing the intended isolation between different teams or departments within a single YouTrack instance. The flaw is particularly insidious because it does not require privilege escalation in terms of account level but rather exploits a logical gap in how cross-project references are handled during bulk operations.
The operational impact of this vulnerability is significant for organizations relying on strict data segregation and role-based access controls. An attacker could potentially alter the status, assignee, or priority of issues belonging to sensitive projects without authorization, leading to inaccurate project metrics, disrupted workflow states, and compromised audit trails. In environments where sprint planning involves cross-functional teams with varying levels of visibility into different product lines, this flaw undermines trust in the tool’s ability to enforce security boundaries. Furthermore, because the action occurs during sprint creation or modification, it may go unnoticed until retrospective reviews reveal discrepancies in issue tracking data for restricted projects. This can lead to operational confusion and potential compliance issues if sensitive development activities are inadvertently exposed or modified by unauthorized personnel.
To mitigate this risk, organizations must immediately upgrade their JetBrains YouTrack instances to version 2026.2.19562 or later, where the access control logic has been corrected to validate permissions for each source issue before allowing it to be moved into a sprint. Until an upgrade is feasible, administrators should restrict who can create sprints and manage bulk issue movements, limiting these actions to users with high-level administrative privileges who are already trusted across all projects. Additionally, reviewing audit logs for unusual patterns of cross-project issue modifications during sprint operations can help identify potential exploitation attempts in unpatched environments. This incident underscores the importance of rigorous input validation that extends beyond immediate object permissions to include contextual checks on related entities within complex relational data models.
This vulnerability is categorized under CWE-269, Improper Privilege Management, as it allows a user to perform actions exceeding their assigned privileges by exploiting logical flaws in access control enforcement. It also aligns with MITRE ATT&CK technique T1078, Valid Accounts, specifically the aspect of using legitimate credentials to bypass security controls through application logic errors rather than credential theft or brute force attacks. The failure to enforce proper authorization checks during data manipulation operations highlights a gap in secure design principles that must be addressed at both the development and deployment stages to ensure robust protection against unauthorized access and modification of critical project artifacts.