Description
In JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed privilege escalation
Published: 2026-09-07
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Unchecked group membership changes in JetBrains YouTrack allow an attacker to arbitrarily modify group memberships and elevate privileges, potentially gaining full administrative control. The weakness is a privilege or access control failure (CWE-266) and could compromise confidentiality, integrity, and availability of the system.

Affected Systems

The vulnerability affects JetBrains YouTrack for versions prior to 2026.2.18634. Users running any older build lack the fix that checks group membership changes before applying them.

Risk and Exploitability

The CVSS score is 8.8, indicating high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires ability to alter group membership, which can be achieved through the web UI or API by users with sufficient permissions; therefore the attack vector is likely remote via the application interface.

Generated by OpenCVE AI on September 7, 2026 at 17:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the JetBrains YouTrack update to version 2026.2.18634 or later to enforce proper group membership checks.
  • Restrict group management permissions to trusted administrators by reviewing user roles and removing unnecessary privileges.
  • Audit group membership changes regularly to detect any unauthorized modifications and verify that the updated system prevents unchecked changes.

Generated by OpenCVE AI on September 7, 2026 at 17:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 07 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Title Unchecked Group Membership Changes Allow Privilege Escalation in JetBrains YouTrack

Mon, 07 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Jetbrains
Jetbrains youtrack
Vendors & Products Jetbrains
Jetbrains youtrack

Mon, 07 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description In JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed privilege escalation
Weaknesses CWE-266
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Jetbrains Youtrack
cve-icon MITRE

Status: PUBLISHED

Assigner: JetBrains

Published:

Updated: 2026-09-07T16:26:42.303Z

Reserved: 2026-09-07T16:13:34.718Z

Link: CVE-2026-86482

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-07T17:17:26.383

Modified: 2026-09-07T17:17:26.383

Link: CVE-2026-86482

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T17:45:17Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment