The reported vulnerability is a server‑side request forgery that can be triggered by configuring custom plugin repositories in JetBrains IntelliJ IDEA before version 2026.3. An attacker who can influence the repository configuration could cause the IDE to send HTTP requests to arbitrary URLs from the host machine. This could lead to information disclosure or further exploitation of internal services that are otherwise inaccessible from the external network, as the IDE performs the requests on the victim's behalf.

JetBrains IntelliJ IDEA versions released prior to 2026.3 are affected. The vulnerability exists in the component that processes the URL of custom plugin repositories. No additional vendor or product variants are listed, so the impact is limited to the standard IntelliJ IDEA distribution.

The CVSS score of 5.3 indicates a moderate level of severity, and the EPSS score is not available, so the current exploit probability is unknown. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no widespread public exploitation at the time of analysis. The likely attack vector is that a user could be tricked into loading a plugin from a malicious repository, or an attacker with access to the IntelliJ configuration could change the repository URL. If successful, the exploit would allow the attacker to reach internal network resources or gather sensitive information.