JetBrains Hub versions before 2026.2.52519 allowed an attacker to achieve privilege escalation by forging an email verification request. The flaw stems from an insufficient check of ownership or receipt of an account object, classified as CWE-863. If an attacker can present a forged verification, they may elevate their privileges or assume another user’s identity within the Hub environment, compromising confidentiality and integrity of the system and its data.

JetBrains Hub by JetBrains. The vulnerability exists in all releases dated prior to 2026.2.52519, regardless of minor sub‑versions. Users running any of those earlier builds are affected; newer releases have been fixed.

The CVSS score of 7.5 indicates a high severity. EPSS is not available, but the flaw is listed as not part of the CISA KEV catalog, suggesting no known active exploits yet. Based on the description, the likely attack vector involves sending a forged verification request through the email verification workflow; the attacker does not need special local access. The vulnerability therefore could be exploited remotely by anyone able to submit such a request, making it a significant risk for any Hub instance that relies on email verification for privilege control.