CVE-2026-49385 in YouTrack
Summary
by MITRE • 05/29/2026
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/05/2026
This vulnerability in JetBrains YouTrack prior to version 2026.1.13570 represents a critical improper access control flaw that enabled low-privileged users to escalate their privileges and modify service accounts. The issue stems from insufficient authorization checks within the application's permission system, allowing unauthorized users to manipulate accounts that should be restricted to administrative or system-level access. This vulnerability directly maps to CWE-284 which defines improper access control as a weakness where a system fails to properly enforce access restrictions on resources. The flaw exists in the application's user permission model where service accounts are not adequately protected from modification by users who lack the appropriate administrative privileges.
The operational impact of this vulnerability is significant as service accounts typically contain elevated privileges and sensitive credentials that are crucial for system operations. When low-privileged users can modify these accounts, they gain access to system resources that should remain protected, potentially leading to complete system compromise. Attackers could leverage this weakness to establish persistent access, escalate privileges, or disrupt normal system operations. The vulnerability creates a direct pathway for privilege escalation attacks and aligns with ATT&CK technique T1078 which covers valid accounts and legitimate credentials for persistence. This type of access control failure can result in unauthorized data modification, system disruption, and potential data breaches when service accounts contain sensitive operational information.
The technical implementation of this flaw suggests that the application's authorization mechanisms failed to properly validate user permissions before allowing modifications to service accounts. This could manifest as missing validation checks in API endpoints, insufficient role-based access controls, or flawed session management that does not properly enforce access restrictions. Organizations using affected versions of YouTrack face a substantial risk as this vulnerability can be exploited by both internal and external threat actors who gain access to low-privileged accounts. The remediation approach requires immediate patching to version 2026.1.13570 or later, which should include enhanced access control validation for service account modifications. Additionally, administrators should review and tighten access controls, implement proper monitoring for unauthorized account modifications, and conduct security assessments to identify any potential exploitation that may have already occurred. The vulnerability underscores the importance of proper access control implementation and demonstrates how inadequate permission validation can create severe security risks in enterprise applications.