JetBrains YouTrack versions before 2026.2.18634 stored GitHub App installation tokens in a shared cache that was not isolated between tenants. This design flaw allowed a tenant to read another tenant’s cached tokens, which can be used to authenticate as that tenant’s GitHub App. The resulting credential compromise could grant an attacker read or write access to any repositories or services the app interacts with, potentially exposing sensitive code or executing unintended actions. The vulnerability is a classic example of improper isolation (CWE‑488).

JetBrains In JetBrains YouTrack, versions prior to 2026.2.18634 are affected.

The vulnerability is rated high with a CVSS score of 8.5, and it is not listed in the CISA KEV catalog. While no EPSS value is available, the lack of tenant boundaries makes exploitation straightforward once an attacker has a legitimate account or session. An attacker can request or enumerate the shared token cache and retrieve any tenant’s installation tokens. With those tokens, the attacker can impersonate the corresponding GitHub App and access or modify the associated repositories or services.