Description

In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-06T11:17:13.200Z",
  "pubdate": "2026-11-06T11:17:13.200Z",
  "executiveSummary": "A missing authorization vulnerability exists within the TeamCity integration feature of JetBrains YouTrack. This security flaw allows unauthorized users to access and disclose sensitive action data from projects to which they should not have access.\nThe vulnerability is classified as an authorization bypass, which circumvents established access control mechanisms designed to isolate project-specific activities.\nThe impact includes unauthorized information disclosure, potentially exposing internal development workflows, build status updates, and project metadata that should be restricted to authorized project members.\nThe issue affects JetBrains YouTrack versions prior to 2026.2.19562. An attacker requires network access to the YouTrack instance and must leverage the specific flaw within the TeamCity integration module to retrieve restricted project data.\nExploitation does not necessarily require administrative privileges, as the lack of server-side authorization checks allows standard users to perform requests that leak information across project boundaries.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of authorization logic within the interface between JetBrains YouTrack and TeamCity. Specifically, the integration component fails to perform adequate verification of the requester's permissions before processing and returning data related to project-specific actions.\nIn a secure implementation, the YouTrack backend should validate that the authenticated user possesses the 'View Project' or equivalent permission for the specific project context before allowing any interaction with integration-related APIs. Due to this missing authorization check, the API endpoint responsible for surfacing TeamCity integration data fails to enforce boundary constraints.\nThe attack flow commences with an authenticated attacker querying the TeamCity integration API endpoints. By manipulating request parameters or identifying specific endpoints that lack context-aware authorization filters, the attacker can request information concerning projects or activities where they hold no formal membership or access rights.\nThe vulnerable component is the integration bridge facilitating communication between the YouTrack application and external TeamCity build servers. This subsystem caches or retrieves activity logs and action states which are inadvertently exposed due to the absence of middleware-level permission checks.\nBecause the server-side logic trusts the incoming request context without re-verifying authorization against the project's access control list (ACL), the system effectively bypasses the Principle of Least Privilege. This allows for horizontal privilege escalation, where a user can view information restricted to other projects or unauthorized users.\nThe vulnerability affects all JetBrains YouTrack deployments running versions prior to 2026.2.19562. While the vulnerability is network-exposed, it requires a valid authentication session on the YouTrack instance. Post-exploitation, an attacker can enumerate cross-project activity, which may include sensitive build triggers, developer usernames, and commit-related metadata associated with protected projects, facilitating reconnaissance for further attacks."
}