Description

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-11-06T11:17:08.140Z",
  "pubdate": "2026-11-06T11:17:08.140Z",
  "executiveSummary": "A privilege escalation vulnerability exists within JetBrains Hub, specifically affecting the email verification workflow.\nThe vulnerability allows an authenticated attacker to manipulate email authentication parameters during the verification process, potentially leading to unauthorized account access or escalation of privileges.\nThe issue affects all versions of JetBrains Hub prior to 2026.2.52556.\nBy successfully exploiting this flaw, an attacker can bypass intended security constraints governing account identity and verification states.\nThis vulnerability poses a significant risk to organizational identity management and internal access control, as it could allow for the subversion of user account protections.\nExploitation requires the attacker to have initial access to the application's verification flow.\nJetBrains Hub deployments running versions older than 2026.2.52556 are vulnerable and must be updated to maintain system integrity.",
  "technicalDetails": "The vulnerability resides within the user identity and authentication management subsystem of JetBrains Hub, specifically targeting the logic responsible for processing email verification requests.\nThe root cause is an insecure handling of state transitions and input validation during the email address verification flow. During this procedure, the application fails to adequately bind the verification token to the initial state or validate that the parameters defining the email authentication details remain immutable throughout the request lifecycle.\nAn attacker can exploit this by initiating a legitimate email verification request and subsequently modifying the associated parameters (such as the target email address or authentication flags) while the request is in transit or being processed by the server.\nBecause the server does not enforce strict integrity checks on these verification parameters after the initial request is generated, the application erroneously processes the modified request.\nIf the application logic implicitly trusts the manipulated input to finalize the account verification state, an attacker can successfully associate an arbitrary or high-privileged email address with their session, or bypass secondary authentication checks that rely on the verification status.\nThe attack flow follows these steps: 1) The attacker initiates an email verification request within the JetBrains Hub environment. 2) The attacker intercepts or identifies the request structure responsible for confirming the email ownership. 3) The attacker modifies the authentication details contained within the payload to point toward a target or to change the identity context. 4) The server validates the modified request as successful, inadvertently updating the user record with the attacker-controlled values.\nThis behavior results in a loss of identity assurance and can lead to full privilege escalation if the verification state is used as a prerequisite for administrative access or account ownership validation.\nThe vulnerability affects all JetBrains Hub versions before 2026.2.52556, as the underlying logic flaw persists in the verification flow implementation across these builds.\nSuccessful exploitation allows for post-exploitation impacts, including unauthorized access to sensitive user data, the ability to reset passwords for targeted accounts, and the potential to assume the identity of administrative or elevated users within the application."
}