CVE-2026-86489 in YouTrack
Summary
by MITRE • 09/07/2026
In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified as a Critical Insecure Direct Object Reference (IDOR) within JetBrains YouTrack versions prior to build 2026.2.18634 represents a significant failure in access control mechanisms, specifically targeting the user profile API endpoint. This flaw allows authenticated users with low privileges or even unauthenticated actors depending on specific configuration states to manipulate object identifiers passed as parameters in HTTP requests. By altering these identifiers, an attacker can bypass intended authorization checks and retrieve sensitive data belonging to other users or organizations within the same YouTrack instance. The core technical deficiency lies in the server-side logic failing to validate that the requesting user possesses explicit permission for the specific resource being accessed, relying instead on client-supplied input without sufficient contextual verification against the current session's permissions matrix.
The operational impact of this vulnerability is severe due to the nature of the data exposed. YouTrack serves as a central hub for issue tracking and project management in many enterprise environments, containing highly confidential information such as bug reports, feature requests, security vulnerabilities under development, and strategic roadmaps. The IDOR flaw specifically enables the disclosure of private issues that are restricted by default to specific teams or individuals. Furthermore, it exposes starred folders which often contain curated collections of high-priority items across multiple organizations hosted on a multi-tenant instance. This leakage compromises not only data confidentiality but also organizational integrity, as competitors or malicious insiders could gain insights into ongoing projects, security patches in progress, and internal operational workflows without triggering standard audit logs associated with direct unauthorized access attempts to restricted pages.
From a classification perspective, this vulnerability aligns directly with CWE-639, which defines Insecure Direct Object Reference vulnerabilities where an application exposes a reference to an internal implementation object such as a file, directory, or database key without proper authorization checks. The exploitation technique maps closely to the ATT&CK framework tactic of Collection and specifically the sub-tactic T1005, Data from Local System, adapted for cloud-based SaaS environments. Attackers utilize this flaw through automated scripts that iterate through sequential user IDs or organization identifiers in API calls, systematically harvesting data at scale. The lack of robust object-level permission validation means that standard role-based access control models are effectively circumvented by simply changing the target resource identifier in the request payload.
Mitigation strategies must prioritize immediate patching to version 2026.2.18634 or later, where JetBrains has implemented strict authorization checks on all user profile API endpoints. For organizations unable to upgrade immediately due to operational constraints, network-level controls such as Web Application Firewalls can be configured to detect and block anomalous patterns of sequential ID enumeration against the affected API paths. Additionally, security teams should review audit logs for unusual access patterns involving private issue retrieval or folder listing requests that deviate from normal user behavior profiles. Long-term remediation involves implementing a comprehensive identity and access management strategy that enforces strict object-level permissions at the application layer rather than relying solely on session-based authentication tokens. Developers must adopt secure coding practices that validate every external input against the current user's explicit permission set before processing any request, ensuring that data exposure is prevented by design rather than through perimeter defenses alone.