CVE-2026-75044 in YouTrack
Summary
by MITRE • 08/17/2026
In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in JetBrains YouTrack versions prior to 2025.3.156085 and specific builds of the 2026 release series represents a critical failure in access control mechanisms within the application's email integration subsystem. Specifically, this flaw resides in the mailbox endpoint handling logic, where the system fails to properly verify that an authenticated user possesses the necessary administrative privileges or ownership rights before executing deletion operations on arbitrary entities. This misconfiguration allows any validly authenticated user, regardless of their role or permission level within the YouTrack instance, to issue requests that result in the removal of data objects such as issues, comments, attachments, or other tracked items without authorization checks being enforced at the point of execution.
From a technical perspective, this defect classifies under CWE-284 Improper Access Control and more specifically aligns with CWE-862 Missing Authorization for critical functions. The root cause typically involves a lack of server-side validation that cross-references the requesting user's identity against an access control list or role-based permissions matrix before processing destructive actions via the API endpoint responsible for mailbox interactions. In many enterprise application frameworks, endpoints handling external integrations like email ingestion are sometimes granted broader privileges to facilitate automated processes, but these same endpoints must still enforce strict authorization checks when invoked by human users. The absence of this check creates a direct path for privilege escalation in terms of data manipulation capabilities, allowing lower-privileged accounts to perform actions reserved for system administrators or project owners.
The operational impact of this vulnerability is severe due to the destructive nature of the affected action. An attacker with access to any valid YouTrack account can exploit this flaw to delete arbitrary entities within the tracked projects. This leads to a significant compromise of data integrity and availability, which are core tenets of the CIA triad in information security. The loss of issue records, historical comments, or attached documentation can disrupt project workflows, cause legal or compliance issues if audit trails are destroyed, and create confusion among team members relying on accurate tracking data. Furthermore, because the deletion is arbitrary, an attacker could target specific high-priority items to sabotage ongoing projects or delete evidence related to past incidents, thereby undermining trust in the tool's reliability as a source of truth for development teams.
This vulnerability maps directly to several techniques within the MITRE ATT&CK framework, particularly T1485 Data Destruction and potentially T1078 Valid Accounts if exploited by an insider threat or compromised user credential. The exploitation vector is likely remote via HTTP requests targeting the specific mailbox endpoint, requiring only authentication credentials which are often easier to obtain through phishing or brute-force attacks compared to gaining administrative access directly. This makes it a high-risk vulnerability for organizations that rely on YouTrack for mission-critical project management and issue tracking.
Mitigation strategies must prioritize immediate patching as outlined by JetBrains in the specified version updates, which include 2025.3.156085 and the relevant 2026 builds. Organizations should verify their current build numbers against these fixed versions and apply patches during the next scheduled maintenance window to ensure that the authorization checks are correctly implemented on the mailbox endpoint. In environments where immediate patching is not feasible, temporary mitigations may include restricting access to the affected API endpoints via network-level controls such as firewalls or reverse proxy rules if possible, although this is less effective than a code fix since legitimate email integration services also require access to these endpoints. Additionally, implementing strict monitoring and alerting on deletion events can help detect exploitation attempts in real-time, allowing security teams to respond quickly to any unauthorized data removal activities. Regular audits of user permissions and adherence to the principle of least privilege are essential preventive measures to reduce the blast radius if such vulnerabilities exist or emerge in future updates.