CVE-2026-123335 in YouTrack
Summary
by MITRE • 11/06/2026
In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in JetBrains YouTrack versions prior to 2026.2.19562, 2026.1.14137, and 2025.3.16904 represents a critical failure in access control mechanisms within the application's tag management subsystem. Specifically, the flaw resides in the API endpoint responsible for attaching tags to issues via the tag issues collection interface. In a properly secured enterprise issue tracking system, any operation that modifies metadata associated with an existing record must verify that the requesting user possesses explicit permissions to edit or manage that specific item. However, due to this implementation defect, the server fails to enforce these authorization checks when processing requests to associate tags with tickets. This allows any authenticated user, regardless of their role or permission set within a project, to attach arbitrary tags to issues they do not own and for which they have no administrative rights.
From a technical perspective, this is classified as an Authorization Bypass vulnerability where the application logic relies on implicit trust rather than explicit verification of access control policies during specific API calls. The attacker can exploit this by crafting HTTP requests that target the tag attachment endpoint with parameters specifying any issue ID within their accessible projects or potentially across all visible issues if cross-project visibility exists. By sending these crafted requests, an unauthorized actor can modify the metadata state of critical project artifacts without triggering permission errors or audit logs related to privilege escalation. This type of flaw is commonly associated with CWE-285 Improper Authorization and falls under MITRE ATT&CK technique T1078 Valid Accounts if leveraged by a compromised user credential, though it primarily represents an application logic error rather than a traditional injection or buffer overflow exploit.
The operational impact of this vulnerability extends beyond simple metadata manipulation. In many development workflows, tags are used to trigger automated pipelines, indicate priority levels for incident response teams, or categorize bugs for release planning. An attacker with malicious intent could attach misleading tags such as critical severity indicators to low-priority issues, causing unnecessary panic and resource diversion among engineering and operations staff. Conversely, they might remove essential classification tags from high-risk items, leading to those issues being overlooked during sprint reviews or security audits. Furthermore, in environments where tagging integrates with external tools like Slack notifications or Jira synchronization services, false tag data can propagate misinformation across the entire DevOps ecosystem, degrading trust in the integrity of the tracking system and potentially causing downstream failures in automated deployment gates that rely on specific issue states for execution decisions.
Mitigation strategies must prioritize immediate patching as well as compensating controls while updates are applied. JetBrains has released fixed versions 2026.2.19562, 2026.1.14137, and 2025.3.16904 which address the authorization logic in the tag issues collection endpoint. Administrators should upgrade to one of these patched releases immediately to restore proper access control enforcement. In addition to patching, organizations should review their current permission schemes to ensure that users with limited editing rights do not have broad write access to issue metadata fields unless explicitly required for their role. Implementing strict input validation and enforcing least-privilege principles on all API endpoints is essential to prevent similar logic flaws in the future. Regular security audits focusing on authorization checks across RESTful interfaces can help identify other potential bypasses where state-changing operations might lack adequate verification of user entitlements against target resources.