CVE-2026-86497 in YouTrack
Summary
by MITRE • 09/07/2026
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.18769 represents a critical authentication and authorization flaw within the application's mail integration subsystem. This issue specifically affects users with project administrator privileges, allowing them to manipulate the configuration of connected mailbox accounts without undergoing re-authentication procedures. The core technical deficiency lies in the server-side validation logic that governs changes to mailbox host settings. When an administrator initiates a modification to the hostname or connection parameters of a configured mail account, the system fails to enforce mandatory credential verification for this specific action. This design oversight creates a state where sensitive authentication tokens and plaintext passwords associated with external email services can be accessed by unauthorized parties who have gained administrative control over a project within the YouTrack instance.
From an operational perspective, this vulnerability enables data exfiltration of stored mailbox credentials. An attacker exploiting this flaw could retrieve the username and password used to authenticate against IMAP or SMTP servers linked to various projects. These credentials often serve as gateways not only to email communications but potentially to other integrated services if credential reuse is practiced by users within the organization. The ability to extract these secrets without re-authentication bypasses standard security controls designed to prevent unauthorized configuration changes, effectively allowing a project administrator to pivot from local administrative access to broader network compromise through compromised email accounts. This scenario aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if the storage mechanism itself is deemed insufficiently protected against privileged abuse.
The exploitation path typically involves navigating to the project administration settings, selecting a configured mail account, and modifying its host parameter. Because the system does not prompt for re-authentication during this specific update operation, the request proceeds with the existing session's privileges but without verifying that the user still possesses valid credentials for the target service or even for YouTrack itself in some configurations. This lack of step-up authentication is a significant deviation from security best practices outlined by OWASP regarding sensitive data exposure and access control failures. The impact extends beyond simple credential theft, as these emails may contain sensitive business intelligence, customer information, or internal communications that are protected under regulations such as GDPR or HIPAA depending on the industry sector.
Mitigation strategies must prioritize immediate software updates to version 2026.2.18769 or later where this logic has been corrected to require re-authentication for any changes to mailbox configurations. In environments where patching is not immediately feasible, administrators should enforce strict role-based access control policies that limit project administrator privileges to only those users who absolutely require them. Additionally, implementing multi-factor authentication across the organization reduces the risk of initial compromise leading to this specific exploitation chain. Security teams should also audit existing mail account configurations and rotate any credentials associated with YouTrack-integrated email services as a precautionary measure until the vulnerability is fully remediated in all affected instances.