In JetBrains Hub versions prior to 2026.2.52366 a missing authorization check permitted any authenticated user to send emails from the server’s trusted address. This flaw can be abused to dispatch arbitrary emails that appear to come from the organization, facilitating phishing and spam campaigns. The vulnerability is classified as CWE‑862, reflecting improper authorization checks, and it undermines the integrity and trustworthiness of the organization’s communications.

Vulnerable installations are JetBrains Hub running any release earlier than 2026.2.52366. The issue applies to all versions lacking the patch referenced in JetBrains’ privacy‑and‑security update notes; operators should verify their Hub version and apply the update if they are within the affected range.

With a CVSS score of 7.7, the flaw carries a high risk rating. Although no EPSS score is presently available, the exploitation path is straightforward for authenticated users, who only need valid Hub credentials to trigger the vulnerability. The flaw is not listed in CISA’s KEV catalog; nevertheless its ability to enable email spoofing presents a significant threat that warrants immediate attention.