Description

In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T11:17:12.913Z",
  "pubdate": "2026-11-06T11:17:12.913Z",
  "executiveSummary": "A vulnerability exists in JetBrains YouTrack versions prior to 2026.2.19562 involving a missing authorization check within the saved query endpoint.\nThe flaw is classified as a Broken Access Control vulnerability, specifically involving unauthorized data exposure.\nAn unauthenticated or unauthorized remote attacker can leverage this flaw to gain unauthorized access to sensitive issue descriptions managed within the YouTrack platform.\nThe primary risk implication is the mass exfiltration of proprietary, sensitive, or confidential project data stored in issue trackers, potentially exposing intellectual property or internal system configurations.\nExploitation does not require elevated privileges or complex interaction, as the vulnerability resides in the application's access control logic for the saved query retrieval process.\nAffected organizations face significant risks to data confidentiality and integrity, as attackers can programmatically query the endpoint to scrape descriptions across accessible projects.",
  "technicalDetails": "The root cause of this vulnerability is a failure to implement consistent authorization checks on the server-side endpoint responsible for retrieving and displaying saved queries.\nIn the affected versions, the API endpoint tasked with handling saved query requests fails to validate the requester's permissions against the target resource's access control list (ACL).\nThe attack flow initiates when an attacker interacts with the vulnerable endpoint, typically by crafting a HTTP GET request targeting the specific URI associated with saved queries.\nBecause the application logic fails to perform an authentication and authorization handshake before processing the request, the backend retrieves the requested data object—in this case, the issue description associated with the saved query—and returns it in the HTTP response body.\nThe attack requires no special credentials, provided the instance is reachable over the network and the attacker can identify the appropriate endpoint. If the endpoint is accessible, the attacker can iterate through identifiers or use automated scripts to harvest information across multiple queries and associated issues.\nThe vulnerable component is the query management subsystem of the YouTrack application, which processes and serializes query definitions for UI/API consumption.\nSuccessful exploitation results in the unauthorized disclosure of information that should be restricted to authenticated users with specific project-level or system-level permissions.\nOnce the sensitive issue descriptions are disclosed, the impact extends beyond simple information leakage; it may enable further attacks by revealing internal infrastructure details, security vulnerabilities, or business logic documented within the issue tracker.\nThe lack of server-side validation means that even if the UI prevents access, the underlying API exposes the data to any request that reaches the controller logic, bypassing the intended security posture of the application."
}