Description

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-11-06T11:17:11.983Z",
  "pubdate": "2026-11-06T11:17:11.983Z",
  "executiveSummary": "An improper URL validation vulnerability exists in the app widget host component of JetBrains YouTrack, identified in versions prior to 2025.3.170763, 2026.1.14150, and 2026.2.19656.\nThe vulnerability manifests as an authorization bypass, allowing malicious or compromised apps to perform unauthorized REST API requests on behalf of the application without requiring explicit user confirmation.\nThis flaw impacts the integrity and confidentiality of the YouTrack instance, as an attacker can leverage the widget host to interact with internal or external resources that the application is authorized to access.\nSuccessful exploitation allows an attacker to execute arbitrary REST operations, potentially leading to unauthorized data exfiltration, modification of system configurations, or interaction with integrated services.\nThe impact is significant for organizations relying on third-party or custom apps, as the lack of user interaction requirements effectively removes the intended human-in-the-loop security control for sensitive API operations.\nExploitation requires the presence of a malicious app or the compromise of an existing authorized app within the YouTrack environment.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient server-side validation of URL targets within the YouTrack app widget host component. When an app initiates a REST request, the application fails to adequately sanitize or verify the destination URL against a strictly defined whitelist or security policy.\nUnder normal operating conditions, apps should only perform requests that are explicitly authorized, and those requiring sensitive state changes or data retrieval typically mandate user confirmation to ensure the request is intentional. Due to the improper validation, the widget host fails to enforce these verification controls.\nThe attack flow begins with an adversary either deploying a malicious app to the YouTrack instance or compromising an existing app that has been granted appropriate permissions. Once active, the app triggers a REST request via the widget host. Because the host does not validate the request context or prompt for user interaction, the underlying application processes the request as if it were an authenticated, user-authorized action.\nThe vulnerable component, the app widget host, acts as an intermediary or proxy for these requests. By failing to authenticate the origin or purpose of the request in the context of the user session, the system allows the app to bypass secondary security checks. This effectively grants the app elevated capabilities, allowing it to act with the privileges of the victim user or the application's service account without any visibility into the malicious activity.\nAffected versions include all instances of JetBrains YouTrack prior to 2025.3.170763, 2026.1.14150, and 2026.2.19656. The exploit relies on the internal API handling mechanisms within these versions where the widget host fails to distinguish between legitimate user-initiated actions and unauthorized automated requests.\nThe post-exploitation impact includes the ability to perform cross-service requests, potential exfiltration of sensitive tickets or user data, and the ability to modify system settings if the exploited application possesses sufficient administrative privileges. Since the requests are performed by the application framework, they may appear legitimate in system audit logs, complicating detection efforts."
}