Description
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects
Published: 2026-09-30
Score: 2.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access to Project Data
Action: Apply Patch
AI Analysis

Impact

JetBrains YouTrack before version 2026.2.19197 has missing authorisation on several endpoints that allow authenticated users to access information from other projects. The flaw provides a way for a logged‑in user to read data they should not see, exposing project information. The weakness is a classic Missing Authorization error (CWE‑862), and the disclosed CVSS score is 2.7, indicating a low overall risk.

Affected Systems

The vulnerability affects JetBrains YouTrack. Any installations using a version earlier than 2026.2.19197 are vulnerable. All standard installations that have not been patched are at risk.

Risk and Exploitability

The CVSS score of 2.7 categorises this as low impact, and the EPSS score is not available. The vulnerability is not listed in CISA KEV, suggesting it is not a known or actively exploited issue. The attack can be carried out by any authenticated user who can reach the affected endpoints; no privilege escalation or complex conditions are required.

Generated by OpenCVE AI on September 30, 2026 at 17:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install JetBrains YouTrack version 2026.2.19197 or later to apply the vendor fix for missing authorisation.
  • Validate that the updated version prevents cross‑project data exposure in the affected endpoints.
  • Continuously monitor system logs for attempts to access data from projects to which the user does not belong.

Generated by OpenCVE AI on September 30, 2026 at 17:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*

Thu, 01 Oct 2026 03:15:00 +0000

Type Values Removed Values Added
First Time appeared Jetbrains
Jetbrains youtrack
Vendors & Products Jetbrains
Jetbrains youtrack

Wed, 30 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Title Authenticated Users Gain Unauthorized Access to Data from Other Projects

Wed, 30 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Jetbrains Youtrack
cve-icon MITRE

Status: PUBLISHED

Assigner: JetBrains

Published:

Updated: 2026-09-30T15:48:38.509Z

Reserved: 2026-09-25T17:02:08.509Z

Link: CVE-2026-100271

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-09-30T16:16:58.433

Modified: 2026-10-02T16:33:51.363

Link: CVE-2026-100271

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T03:00:14Z

Weaknesses