CVE-2026-75045 in YouTrack
Summary
by MITRE • 08/17/2026
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in JetBrains YouTrack versions prior to 2025.3.156085, 2026.1.13913, and 2026.2.18112 represents a critical security flaw that allows unauthenticated attackers to access sensitive database backups through the manipulation of shared draft signatures. This issue stems from an improper restriction on file download mechanisms within the application's handling of document drafts and their associated sharing protocols. When users create or edit documents, YouTrack generates temporary links or signatures to facilitate collaboration. However, in these affected versions, the validation logic for these shared draft signatures fails to adequately verify whether the requested resource is a protected system artifact, such as an automated database backup file, rather than just user-generated content. Consequently, if an attacker can discover or guess the structure of these signature parameters, they can bypass authentication checks and directly retrieve binary copies of the underlying database backups.
From a technical perspective, this flaw aligns with CWE-284, Improper Access Control, as it involves a failure to enforce proper restrictions on unauthenticated users regarding sensitive system resources. Furthermore, the exploitation method relates to CWE-601, URL Redirection to Untrusted Site (Open Redirect), in contexts where signature parameters might be manipulated or if the application relies on predictable patterns for generating access tokens for drafts. The vulnerability is also categorized under MITRE ATT&CK technique T1530, Data from Cloud Storage Object, as it involves exfiltrating data stored within the system's internal storage mechanisms that are intended to be private and secure. The core technical deficiency lies in the server-side logic that processes requests containing draft signatures; instead of strictly limiting access to only those files explicitly marked for public or shared viewing by authenticated users with specific permissions, the application inadvertently exposes administrative backup artifacts due to a lack of strict type checking on the file path or identifier associated with the signature.
The operational impact of this vulnerability is severe, primarily concerning data confidentiality and integrity. Database backups typically contain comprehensive snapshots of all system data, including user credentials, personal identifiable information (PII), project details, comments, attachments, and potentially hashed passwords or session tokens. An unauthenticated attacker who successfully exploits this flaw can download these backups without any prior authentication or authorization. This leads to a complete compromise of the confidentiality of the organization's data hosted on YouTrack. The extracted data could be used for further attacks such as credential stuffing, social engineering based on exposed employee information, or reverse-engineering application logic if source code is included in attachments within tickets. Additionally, depending on how the backups are stored and processed by external tools, there may be secondary risks involving integrity violations if attackers were to modify backup files before restoration, although the primary risk here is unauthorized access and exfiltration of static data.
Mitigation strategies must focus on immediate patching and defensive configuration adjustments. JetBrains has addressed this issue in versions 2025.3.156085, 2026.1.13913, and 2026.2.18112 onwards; therefore, the primary remediation step is to upgrade the YouTrack instance to one of these patched versions or later. For organizations unable to patch immediately due to operational constraints, it is crucial to review network access controls. Ensuring that the YouTrack server is not directly exposed to the public internet without a robust Web Application Firewall (WAF) can help mitigate exploitation attempts by filtering malicious requests targeting draft signature endpoints. Administrators should also audit their backup retention policies and ensure that database backups are stored in secure, isolated storage locations with strict access controls separate from the web application's document serving paths where possible. Regular security audits focusing on file download mechanisms and shared link generation logic will help prevent similar vulnerabilities in future updates or custom integrations.