Description

In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-06T11:17:12.720Z",
  "pubdate": "2026-11-06T11:17:12.720Z",
  "executiveSummary": "An incorrect authorization vulnerability has been identified in JetBrains YouTrack prior to version 2026.2.19197. The flaw resides within the scripts debugger component, which fails to properly validate and enforce access control permissions for interacting with executing or registered workflow scripts.\nExploitation of this vulnerability enables unauthorized users to interact with debugging interfaces, leading to workflow script disclosure and arbitrary script suspension. Successful attacks expose sensitive workflow source code, proprietary business logic, and potentially embedded system data. Additionally, the ability to suspend script execution allows attackers to disrupt automated operational processes, issue processing, and custom application workflows.\nOrganization risks include data exposure and operational disruption across affected JetBrains YouTrack instances. To mitigate these risks, instances must be updated to version 2026.2.19197 or later.",
  "technicalDetails": "The root cause of this security defect is an improper access control implementation within the script debugging module of JetBrains YouTrack. Workflow scripts in JetBrains YouTrack handle automation, state transitions, custom integration logic, and project management tasks. The scripts debugger provides functionality to monitor, step through, and control script execution states. However, versions prior to 2026.2.19197 fail to adequately verify user privileges when requests are submitted to the debugging routines.\nAn attacker with network access to the YouTrack application can target the exposed script debugger endpoints. Because authorization checks are missing or insufficiently enforced, the application processes debugging commands regardless of whether the requesting identity possesses administrative or script-management privileges. The exploitation does not require complex memory corruption; rather, it relies on submitting improperly authorized control commands directly to the debugger service.\nThe attack flow proceeds in two primary phases: information disclosure and workflow disruption. First, an unauthorized attacker sends requests to inspect the active debugging session or stored script routines. The scripts debugger responds by revealing the underlying workflow script source code. This workflow script disclosure compromises internal custom logic, automation flows, internal infrastructure paths, and potentially sensitive tokens or parameters embedded within script definitions.\nSecond, the attacker leverages debugger execution control commands to manipulate running workflow processes. By sending suspension directives through the unauthorized debugging channel, the attacker can halt active script executions (workflow script suspension). This prevents critical business rules, state change triggers, and background task handlers from executing to completion, causing functional denial of service across project management processes.\nThe vulnerability affects all installations of JetBrains YouTrack preceding version 2026.2.19197 where the scripts debugger functionality is reachable by non-administrative users. Remediation requires patching the backend component to enforce strict role-based access checks prior to processing debugger API calls."
}