JetBrains IntelliJ IDEA versions prior to 2026.3 contain improper checks that allow disabled plugins to be enabled through external dependency settings. This flaw enables a user to bypass intended restrictions and activate plugins that were explicitly disabled, potentially allowing the execution of unwanted code under the IDE context. The vulnerability is a low‑severity flaw (CWE‑829) and does not directly compromise confidentiality or integrity of data, but it can undermine policy controls and increase the attack surface. The CVSS score of 3.3 reflects its limited impact and the lack of remote exploitation vector.

JetBrains IntelliJ IDEA installations before the 2026.3 release are affected. Users running any earlier version of the IDE should verify their current release and plan an upgrade as soon as possible.

The CVSS score of 3.3 indicates low overall risk, and the EPSS score is currently unavailable, suggesting no known public exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker who can log into the development machine and edit the IDE’s external dependency settings can trigger the flaw. No network‑based exploitation is documented, and the required privilege level is that of a local user with access to the IDE configuration.