JetBrains Hub has a missing authorisation check that lets users with read‑only access modify authentication module group mappings. The flaw is a classic lack of Authorization, classed as CWE‑862, enabling unauthorized privilege escalation for users who otherwise cannot change group memberships. The impact is a compromise of access controls and the potential that attackers can elevate privileges within the Hub ecosystem.

The vulnerability affects JetBrains Hub products prior to version 2026.2.52519. No other products or versions are listed as affected.

The CVSS score of 2.7 indicates a low overall severity; the EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, suggesting a modest current threat landscape. The likely attack vector is internal, where a user with read‑only privileges can exploit the missing check to alter group mappings. Exploitation requires access to the Hub instance; no external network exposure is indicated in the description.