Description

In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-06T11:17:12.120Z",
  "pubdate": "2026-11-06T11:17:12.120Z",
  "executiveSummary": "A vulnerability in JetBrains YouTrack allows unauthorized information disclosure through shared mailbox message history. This security flaw enables unauthorized entities to access sensitive communication logs that should be restricted based on permissions. The vulnerability affects versions of JetBrains YouTrack prior to 2026.2.19562. The primary risk involves the exposure of potentially confidential, proprietary, or sensitive data exchanged via integrated email systems. An attacker exploiting this vulnerability does not require complex infrastructure, but rather relies on the failure of the application to properly enforce access control logic within the shared mailbox component. Successfully exploiting this flaw could lead to significant data breaches, compliance violations, and the exposure of internal business processes or customer-sensitive information stored within email threads.",
  "technicalDetails": "The vulnerability originates from improper access control enforcement within the shared mailbox message history retrieval logic of JetBrains YouTrack. In environments where YouTrack is configured to integrate with shared mailboxes for issue tracking and ticketing, the application interface fails to adequately validate the authorization context of the user requesting access to message history logs.\nThe root cause lies in a logic flaw within the backend API or internal service responsible for fetching email threading data. When a user requests historical messages associated with a specific issue or shared mailbox, the system neglects to verify whether the authenticated user possesses the appropriate read permissions for the specific mail container or the associated issue. This permits unauthorized users—who may only have access to specific projects or tickets—to view the historical message history of the shared mailbox.\nExploitation follows a predictable flow: 1) The attacker authenticates as a legitimate user within the YouTrack environment. 2) The attacker navigates to an area where shared mailbox messages are processed or indexed. 3) By crafting a request or browsing specific endpoints associated with the mailbox integration, the attacker triggers the retrieval of historical message data. 4) The server, failing to perform an identity-based authorization check against the requested message object, returns the sensitive email history payload to the attacker's client session.\nThe lack of granular filtering and validation means that information leakage can occur across different administrative boundaries. Because the vulnerability exists within the application's core handler for shared mailbox communications, it is not limited to a single peripheral feature. The post-exploitation impact includes the systematic scraping or manual observation of private communications, internal discussions, and external correspondence that was intended only for authorized mailbox managers or specific ticket assignees. This exposure remains active until the underlying authorization logic is corrected in the specified patch version. The vulnerability is applicable to all YouTrack deployments using shared mailbox integration prior to version 2026.2.19562."
}