CVE-2026-123337 in YouTrack
Summary
by MITRE • 11/06/2026
In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.19656 represents a critical authorization failure within the application's access control mechanisms, specifically affecting how issue visibility is managed across different user roles. In enterprise environments utilizing YouTrack for project management and bug tracking, maintaining strict data confidentiality is paramount as issues often contain sensitive information regarding product defects, security flaws, or strategic business decisions. The flaw allows users who lack explicit permissions to modify system configurations or update specific fields to alter the visibility settings of existing issues. This capability bypasses the intended role-based access control model, enabling unauthorized individuals to expand or restrict access to issue data without proper administrative oversight.
From a technical perspective, this defect falls under the category of broken access control, which is consistently ranked as one of the most significant risks in web applications according to the OWASP Top 10 security threats list. Specifically, it aligns with CWE-269, Improper Privilege Management, where an actor can perform actions beyond their assigned privileges. The underlying mechanism likely involves insufficient validation on the server side when processing requests related to issue metadata updates. Instead of verifying that the requesting user possesses the specific update permission required for visibility changes, the application accepts and processes these modifications based on broader or default permissions associated with lower-privileged accounts. This logic error permits a lateral escalation of privileges in terms of data access rather than system control, allowing non-administrative users to manipulate who can view sensitive records.
The operational impact of this vulnerability is substantial for organizations relying on YouTrack as their primary issue tracking platform. Unauthorized modification of issue visibility can lead to significant information leakage or unintended data concealment. If a user expands the visibility scope, confidential issues may become accessible to external parties, competitors, or internal teams that should not have access, potentially violating compliance requirements such as GDPR, HIPAA, or SOC2. Conversely, if an attacker restricts visibility, it can disrupt workflow by hiding critical bugs from developers and project managers, leading to delayed resolutions and potential service outages. This lack of integrity in the data layer undermines trust in the system's ability to enforce security policies consistently across all user levels.
In terms of threat modeling, this vulnerability facilitates actions consistent with ATT&CK technique T1078, Valid Accounts, where an attacker uses legitimate credentials but exploits misconfigurations or logic flaws to access resources they are not authorized for. It also relates to T1530, Data from Information Repositories, as the primary goal is often to exfiltrate sensitive data by ensuring it becomes visible to unauthorized viewers. The absence of proper authorization checks means that any authenticated user can potentially act as a conduit for information disclosure without triggering typical security alerts associated with brute force or injection attacks.
To mitigate this risk, organizations must immediately upgrade their JetBrains YouTrack instances to version 2026.2.19656 or later, where the access control logic has been corrected to enforce strict permission checks on visibility modification endpoints. Until patching is complete, administrators should review user roles and permissions within the system, ensuring that only designated project leads or security officers have any ability to alter issue attributes beyond basic editing rights. Implementing additional monitoring for unusual patterns in metadata updates can also help detect potential exploitation attempts. Regular audits of access control policies are essential to ensure that privilege assignments remain aligned with organizational security requirements and do not inadvertently grant excessive permissions through default configurations or legacy role definitions.