CVE-2026-86479 in YouTrack
Summary
by MITRE • 09/07/2026
In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in JetBrains YouTrack prior to versions 2026.2.18788, 2026.1.14055, and 2025.3.161254 represents a critical failure in access control mechanisms within the application's REST API layer. This flaw is classified as an Insecure Direct Object Reference (IDOR), which corresponds to CWE-639 in the Common Weakness Enumeration standard. IDOR vulnerabilities occur when an application uses user-supplied input to directly access objects such as database records, files, or internal process identifiers without performing adequate authorization checks to ensure that the requesting user has permission to view or modify that specific resource. In this context, the REST API endpoints responsible for retrieving or manipulating YouTrack entities failed to validate whether the authenticated session associated with the request possessed the necessary privileges relative to the target object identified by its unique identifier.
From a technical perspective, the root cause lies in the server-side logic handling HTTP requests directed at specific resource URLs containing numeric or alphanumeric identifiers. When an API consumer submits a request targeting a particular issue, project, or user profile via these endpoints, the backend processes the provided ID and retrieves the corresponding data from the database. However, the implementation neglected to cross-reference this identifier against the permissions of the authenticated user making the call. Consequently, any validly authenticated user could manipulate the resource parameter in the API request URL to point towards entities belonging to other users or restricted administrative sections that they should not have access to. This bypasses the intended role-based access control (RBAC) policies embedded within the application's security model, allowing for unauthorized data exposure and potential modification of sensitive information stored within the YouTrack instance.
The operational impact of this vulnerability is significant, particularly in enterprise environments where multiple teams or departments share a single YouTrack deployment with varying levels of privilege. An attacker who has obtained valid credentials to any standard user account can exploit this flaw to enumerate internal project structures, read confidential issue descriptions containing proprietary business logic or security details, and potentially alter the status or assignment of tasks belonging to other users. This capability undermines data integrity and confidentiality, violating core principles of information security. Furthermore, because REST APIs are often consumed by automated tools and integrations, an attacker could script these requests for large-scale data exfiltration without triggering typical manual audit alerts associated with interactive web interface misuse. The lack of proper authorization checks effectively renders the authentication mechanism insufficient for protecting specific resource endpoints, creating a wide attack surface for privilege escalation through information disclosure.
This vulnerability aligns closely with MITRE ATT&CK technique T1078, specifically Valid Accounts, as it relies on legitimate credentials to access unauthorized resources, and falls under the broader category of Improper Access Control (T1288). It also reflects weaknesses in API security often highlighted by OWASP API Security Top 10, particularly Broken Object Level Authorization. To mitigate this risk, organizations must immediately upgrade their JetBrains YouTrack instances to version 2026.2.18788 or later, where the vendor has implemented stricter authorization checks on all affected REST API endpoints. Until an upgrade is feasible, administrators should consider implementing a Web Application Firewall (WAF) with rules designed to detect and block anomalous patterns of IDOR exploitation, such as sequential enumeration of resource IDs by unauthorized users. Additionally, rigorous code reviews focusing on access control logic in custom plugins or integrations interacting with the API are recommended to ensure that no other endpoints suffer from similar deficiencies. Regular security audits and penetration testing should be conducted to verify that all object-level permissions are correctly enforced across the application's entire attack surface.