CVE-2026-75049 in YouTrack
Summary
by MITRE • 08/17/2026
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in JetBrains YouTrack versions prior to build numbers 2026.1.13903 and 2026.2.17950 represents a critical authorization flaw within the application's project management interface. This issue specifically affects authenticated users who possess valid credentials for accessing the system but may not have explicit permissions to view certain restricted articles or issues in other projects. The core of the vulnerability lies in how the draft creation endpoint handles access control checks when processing requests to create new work items or notes. Instead of validating whether the user has read access to the target project's content before allowing interaction with its associated data structures, the system fails to enforce proper separation between different project scopes during the drafting phase.
From a technical perspective, this flaw allows an attacker who is logged into YouTrack as a legitimate user to exploit the draft creation mechanism to retrieve sensitive information from projects they are not authorized to access. By crafting specific HTTP requests directed at the internal API endpoint responsible for handling drafts, the malicious actor can bypass standard permission checks that would normally restrict visibility of private or restricted articles. This behavior indicates a breakdown in object-level authorization controls, where the application trusts user-supplied identifiers without sufficiently verifying if those identifiers correspond to resources accessible by the current session's privilege level. The vulnerability effectively turns a feature designed for convenience and workflow continuity into a vector for unauthorized data exfiltration.
The operational impact of this vulnerability is significant for organizations relying on YouTrack for secure project tracking, especially in environments where multiple teams work within isolated projects containing sensitive intellectual property or confidential business logic. An authenticated insider threat or an external attacker who has compromised low-privilege credentials can leverage this flaw to gather intelligence about other departments' activities, uncover architectural details, or identify potential security gaps by reading restricted discussions and issue descriptions. This undermines the fundamental principle of least privilege within multi-project setups and compromises data confidentiality across organizational boundaries managed through a single YouTrack instance.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting scenarios where authorization checks are bypassed or improperly implemented for specific API endpoints. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, as the exploitation relies on legitimate authentication credentials rather than unauthenticated access. Furthermore, it relates to T1530 Data from Cloud Storage Objects if viewed through the lens of accessing restricted data stores within a SaaS or self-hosted application environment. The failure to enforce strict project-level isolation during draft operations highlights a need for rigorous review of API endpoint security configurations and input validation logic in enterprise software development lifecycles.
To mitigate this risk, organizations running affected versions must immediately upgrade JetBrains YouTrack to version 2026.1.13903 or later, which includes patches addressing the authorization checks on the draft creation endpoint. Until an update can be applied, administrators should review user permissions and consider restricting access to internal APIs if possible through network-level controls such as firewalls or API gateways that enforce stricter authentication policies. Additionally, implementing comprehensive logging and monitoring for unusual patterns in draft creation requests across different projects can help detect potential exploitation attempts early. Regular security audits focusing on role-based access control implementations are recommended to prevent similar authorization bypasses in other parts of the application infrastructure.