CVE-2026-75051 in YouTrack
Summary
by MITRE • 08/17/2026
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.17917 represents a critical failure in access control mechanisms, specifically within the multi-tenant architecture that supports organizational data isolation. This flaw allows an authenticated user who possesses administrative privileges or specific project management permissions within one organization entity to initiate and complete the transfer of projects belonging to their own organization into another distinct organization entity without proper authorization checks from the target organization's administrators. In a typical enterprise deployment, YouTrack serves as a central hub for issue tracking, agile planning, and collaboration across multiple teams or subsidiaries. The system relies on strict boundaries between these organizational units to ensure that sensitive project data, intellectual property, and workflow configurations remain isolated unless explicitly shared through approved channels.
The technical root cause of this vulnerability lies in the insufficient validation of cross-organization permissions during the project transfer operation. When a user attempts to move a project from one organization container to another, the backend logic fails to verify whether the target organization has granted explicit consent or if the transferring entity holds sufficient rights within that specific context. This oversight effectively bypasses the intended security model where administrative actions affecting shared resources require mutual confirmation or elevated privileges in both source and destination contexts. As a result, an attacker with access to one organizational account can unilaterally reassign project data, including issues, comments, attachments, and custom fields, to another organization they control or have influence over.
The operational impact of this vulnerability is severe, particularly for organizations that utilize YouTrack for managing sensitive development lifecycles or proprietary information. Unauthorized project transfers can lead to the leakage of confidential code review histories, strategic roadmap details, and customer-specific bug reports. This breach of data integrity undermines trust in the platform's multi-tenancy model and may violate regulatory compliance requirements such as GDPR, HIPAA, or SOC2, which mandate strict access controls and auditability for sensitive data. Furthermore, if an attacker transfers projects to a compromised external organization, they could potentially exfiltrate large volumes of structured data by accessing it through the target environment's APIs or interfaces, facilitating further reconnaissance or social engineering attacks against other stakeholders linked within those transferred projects.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Privilege Management, as well as CWE-862, Missing Authorization, because the system fails to enforce proper access control policies for cross-entity operations. In terms of adversarial tactics, it maps to MITRE ATT&CK technique T1074, Data Staged, where attackers collect and stage data in a central location or directory prior to exfiltration, as well as T1530, Data from Cloud Storage Object, if the transferred projects contain linked cloud resources. The ability to move entire project containers effectively allows an attacker to pivot access across organizational boundaries without triggering standard alerts associated with direct file downloads or API abuse within a single tenant.
Mitigation strategies must prioritize immediate upgrading of the YouTrack instance to version 2026.2.17917 or later, where JetBrains has implemented stricter validation logic for cross-organization project transfers. Administrators should also review existing user roles and permissions to ensure that only trusted individuals with explicit business justification are granted rights to manage projects across organizational boundaries. Implementing additional monitoring through audit logs can help detect unusual patterns of project movement between organizations, serving as a compensating control until the patch is applied. Regular security assessments focusing on identity and access management configurations within multi-tenant SaaS environments remain essential to prevent similar privilege escalation or data exfiltration vectors in future updates.