JetBrains Hub versions prior to 2026.2.52556 allow an attacker to elevate privileges by altering email authentication details during the account verification process. This vulnerability is a classic privilege escalation flaw (CWE-915) that can enable an unauthenticated or low‑privilege user to gain higher‑level access within the Hub system without proper authorization. The impact is severe, allowing attackers to potentially read, modify, or delete sensitive data, and to perform privileged administrative actions. The flaw resides in the flow that handles email verification, where changes to authentication settings bypass normal permission checks.

Affected systems are JetBrains Hub deployments running a version earlier than 2026.2.52556. Only releases before this build are vulnerable; upgrading to 2026.2.52556 or later removes the flaw.

The CVSS score of 9.6 classifies this as Critical. EPSS is not available, indicating no publicly known exploitation rate data, but the lack of KEV listing does not reduce its threat. Based on the description, it is inferred that the attack vector is through the web‑based email verification workflow; an attacker may exploit it by sending crafted verification requests with altered email authentication parameters. Given the high severity and the nature of the flaw, an exploit would likely be straightforward for an attacker with access to the Hub's verification interface.