JetBrains Hub versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429 allow an actor to elevate privileges by attaching authentication details to user accounts. This flaw enables an attacker to assume higher-level permissions and potentially gain full control of the Hub instance, presenting a severe threat to confidentiality, integrity, and availability.

The affected product is JetBrains Hub from JetBrains. The vulnerability exists in the listed versions listed above. Users running any of these releases should verify their version and plan to upgrade.

The CVSS score of 9.6 marks this issue as critical. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker with access to the account attachment functionality, possibly an authenticated user or an attacker who can submit authentication details. The vulnerability permits elevation of privileges without needing to compromise the underlying operating system, making it highly valuable for malicious actors.