Description

In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-11-06T11:17:08.797Z",
  "pubdate": "2026-11-06T11:17:08.797Z",
  "executiveSummary": "A security vulnerability categorized as an information disclosure issue exists within JetBrains Hub versions prior to 2026.2.52519. The flaw resides in the application's user search functionality, potentially allowing unauthorized entities to retrieve sensitive data.\nThe vulnerability permits an attacker to perform search queries that return information which should otherwise be restricted or hidden based on established access control policies. By exploiting this weakness, an attacker with network access to the Hub instance could potentially gain insight into user details, directory structures, or other indexed attributes that remain exposed through the search mechanism.\nThe impact involves a breach of data confidentiality. The severity is contingent upon the sensitivity of the user-related information managed within the specific Hub deployment and the configuration of visibility permissions. No specialized privileges are explicitly required beyond the ability to interact with the search interface, making this a significant concern for environments where user information must be strictly governed.",
  "technicalDetails": "The vulnerability in JetBrains Hub stems from an improper implementation of access control checks within the backend search query processing engine. In affected versions prior to 2026.2.52519, the search service fails to adequately validate the authorization context of the requesting user against the visibility settings of the returned user profile objects.\nSpecifically, the root cause lies in the application's failure to enforce object-level security filters during the execution of user search queries. When a search request is initiated, the search handler constructs a query against the underlying user database or index. While the front-end may limit search visibility, the backend service fails to strictly sanitize the result set based on the requester's permissions or the target user's visibility scope.\nThe attack flow begins with an attacker crafting a targeted search query against the JetBrains Hub search endpoint. Because the validation logic is insufficient, the search engine processes the request and retrieves user entities from the data store without applying the necessary authorization masks. This results in the server transmitting user information back to the client that the requester should not have been authorized to view. The payload typically involves standard search parameters which, due to the flaw, bypass intended information leakage protections.\nThis vulnerability is particularly concerning as it exposes potentially sensitive metadata associated with user accounts. The post-exploitation impact includes the systematic enumeration of user accounts, the harvesting of email addresses, and the mapping of internal organizational structures, which can be leveraged for further reconnaissance or targeted social engineering attacks. The vulnerability is exploitable over the network, and the lack of robust restriction on search queries means that an authenticated or sometimes unauthenticated attacker could iterate through search terms to perform bulk data extraction. The defect is inherent in the search component logic, requiring a code-level fix to ensure that every query is explicitly validated against the authorization matrix of the current session before the result set is serialized for transmission."
}