CVE-2026-86498 in YouTrack
Summary
by MITRE • 09/07/2026
In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in JetBrains YouTrack prior to version 2025.3.160480 and the 2026.1.14047 release represents a critical authorization flaw within the application's REST API implementation, specifically affecting PUT requests directed at link sub-resources. This issue stems from an insufficient access control mechanism where the system fails to properly validate whether the authenticated user possesses the necessary update permissions for the primary entity being linked or modified through these endpoints. In typical enterprise workflow management systems like YouTrack, links between issues are not merely cosmetic connections but often trigger state changes, assign responsibilities, or modify metadata associated with both the source and target entities. By allowing unauthorized users to manipulate these link sub-resources via HTTP PUT operations, attackers can effectively bypass standard permission checks that would otherwise restrict such modifications.
From a technical perspective, this flaw aligns closely with CWE-269, which describes Improper Privilege Management, as well as CWE-862, the Missing Authorization check. The root cause lies in the API endpoint logic where the validation of user privileges is either skipped or incorrectly scoped to only the link object itself rather than the underlying entities involved in the relationship. When a client sends a PUT request to modify a link between two issues, the server processes the change without verifying if the requester has explicit write access to update the properties of those linked items. This architectural oversight enables an attacker with low-level or read-only permissions on specific projects or issue types to escalate their influence by altering relationships that dictate workflow progression, priority assignments, or dependency tracking.
The operational impact of this vulnerability is significant for organizations relying on YouTrack for project management and defect tracking. An authenticated user exploiting this flaw can corrupt the integrity of project data by creating false dependencies between issues, thereby misleading developers about task priorities and interdependencies. Furthermore, it allows for unauthorized modification of linked entities, which may include changing status fields, assigning tasks to users without their consent, or altering summary details that are governed by strict access policies. This undermines the principle of least privilege and can lead to confusion in development pipelines, potential data integrity issues, and a breach of trust within team workflows. In severe cases, this could be leveraged as part of a broader attack chain to disrupt service availability or manipulate audit trails if logging mechanisms do not adequately distinguish between legitimate administrative actions and those performed through this API abuse vector.
Mitigation strategies primarily involve upgrading the YouTrack instance to version 2025.3.160480 or later, where JetBrains has implemented stricter authorization checks for link sub-resource operations. Until an upgrade is feasible, administrators should restrict direct access to the REST API endpoints associated with issue linking by configuring network-level firewalls or reverse proxy rules to limit PUT requests from untrusted sources. Additionally, implementing robust monitoring and alerting on unusual patterns of API activity can help detect exploitation attempts in real-time. It is also advisable to review existing user permissions and ensure that no accounts have excessive privileges that could be abused through this specific vector, adhering to industry best practices outlined in the MITRE ATT&CK framework under techniques related to privilege escalation and unauthorized access via application layer vulnerabilities.