Description

In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-06T11:17:13.330Z",
  "pubdate": "2026-11-06T11:17:13.330Z",
  "executiveSummary": "A broken access control vulnerability exists in JetBrains YouTrack versions prior to 2026.2.19562, specifically concerning the management of issue visibility settings.\nThe vulnerability allows authenticated users granted only read-only permissions to perform unauthorized modifications to the visibility constraints of issues.\nThis flaw represents a significant security oversight regarding the principle of least privilege, as it enables low-privileged users to bypass intended access controls.\nThe impact includes the potential for unauthorized information disclosure or, conversely, the restricted concealment of sensitive project management data.\nAttackers require valid read-only credentials to exploit this vulnerability, which is reachable via the product's internal API or web interface.\nThe risk is primarily classified as an authorization bypass, which compromises the integrity of project visibility policies and internal data classification schemas.",
  "technicalDetails": "The vulnerability resides within the YouTrack authorization enforcement logic, specifically affecting the components responsible for validating user permissions during issue update operations.\nIn affected versions, the access control check failed to adequately verify whether the requesting user possessed sufficient administrative or write-level privileges before committing changes to an issue's visibility settings.\nThe root cause is a flaw in the server-side validation layer, where the system incorrectly assumed that the presence of valid authentication was sufficient to grant permission to modify visibility metadata, failing to distinguish between 'read-only' and 'update' access scopes.\nThe attack flow proceeds as follows: 1) An authenticated user with read-only access identifies an issue where they wish to alter the visibility scope (e.g., changing from private to public or vice versa). 2) The user intercepts or crafts a request to the YouTrack backend API endpoint responsible for updating issue metadata. 3) The request includes parameters targeting the visibility settings. 4) Because the backend component fails to re-verify the specific authorization requirements for visibility fields, the application processes the request and updates the database state accordingly.\nThis behavior bypasses the expected granular permission model of the application. The exploitation does not require advanced technical skills, merely the capability to trigger a standard API or UI action that updates an issue's security scope.\nPost-exploitation, an attacker can manipulate the accessibility of sensitive project information. An attacker could elevate the visibility of confidential issues to a broader audience or restrict access to issues that were intended to be visible to others, thereby disrupting team workflows or causing data leakage.\nThe vulnerability is limited to the scope of visibility modification and does not necessarily imply full administrative control over the underlying data store; however, it breaks the core security boundary of project issue management."
}