CVE-2026-123334 in YouTrack
Summary
by MITRE • 11/06/2026
In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
A critical authorization flaw exists in versions of JetBrains YouTrack prior to build 2026.2.19562, specifically affecting the handling of version control system integration permissions within linked or related projects. The vulnerability stems from an insufficient access control mechanism that fails to properly validate ownership boundaries when administrators attempt to modify project configurations. In a typical enterprise deployment using YouTrack for issue tracking and development workflow management, organizations often establish relationships between multiple projects to reflect complex software architectures where one module depends on another. These relational links are intended to facilitate cross-project visibility and reporting but were inadvertently exploited as a bypass vector for administrative privileges that should be strictly scoped to individual project boundaries.
The technical root cause involves the backend logic governing VCS integration management endpoints not verifying whether the requesting administrator holds ownership rights over the specific resource being modified, rather than merely having administrative access within a related context. When an admin user associated with Project A attempts to delete a VCS webhook or repository connection configured for Project B, provided that Project A and Project B are linked in some manner defined by the platform's relationship model, the system erroneously grants this operation. This behavior violates the principle of least privilege and fails to enforce strict object-level authorization checks. The flaw allows an attacker with administrative privileges on one project to disrupt the continuous integration pipelines or source code synchronization processes associated with another distinct project within the same instance.
The operational impact of this vulnerability is significant for organizations relying on automated development workflows. By deleting VCS integrations, a malicious actor or compromised account can sever the connection between YouTrack and external version control systems such as GitHub, GitLab, Bitbucket, or Perforce. This disruption prevents automatic issue creation from commits, halts status updates in tickets based on code changes, and breaks automated deployment triggers tied to repository events. In severe cases, this could lead to a denial of service for development teams who depend on these integrations for daily operations, causing delays in release cycles and potential data inconsistency if manual reconciliation is required. Furthermore, the ability to remove security-critical webhooks might hinder incident response capabilities that rely on real-time notifications from code repositories regarding suspicious activity or branch modifications.
This vulnerability aligns with CWE-269, Improper Privilege Management, as it involves an actor obtaining privileges they are not authorized to possess by exploiting a logical flaw in access control rules rather than breaking cryptographic protections. It also maps to MITRE ATT&CK technique T1485.003, Destruction of Data via Cloud Storage or Application API, specifically under the sub-technique of destroying data through application-level actions that disrupt service availability and integrity. The attack vector is primarily local within a trusted network environment where an insider threat or compromised admin account exists, though it could be exacerbated if external-facing administrative interfaces are exposed without additional multi-factor authentication layers.
Mitigation strategies require immediate upgrading to JetBrains YouTrack version 2026.2.19562 or later, which contains the corrected access control logic that strictly enforces ownership validation for VCS integration modifications. Until an upgrade is feasible, administrators should review existing project relationships and restrict administrative roles to only those users who absolutely require cross-project management capabilities. Implementing strict role-based access controls with separate admin accounts for distinct projects can limit the blast radius of such a flaw. Additionally, enabling comprehensive audit logging on all configuration change endpoints allows security teams to detect unauthorized deletion attempts or patterns indicative of this exploitation technique. Regularly reviewing and minimizing VCS integrations to only those strictly necessary reduces the attack surface available for disruption.