Description

In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-06T11:17:13.460Z",
  "pubdate": "2026-11-06T11:17:13.460Z",
  "executiveSummary": "A critical access control vulnerability exists in JetBrains YouTrack versions prior to 2026.2.19197, categorized as an Improper Authorization flaw. The vulnerability allows users with article editing privileges to manipulate the visibility settings of child articles, even when those articles are restricted.\nThis represents a significant security oversight regarding information disclosure and authorization boundaries within the YouTrack Knowledge Base. By bypassing intended visibility restrictions, an attacker possessing standard 'Article Editor' permissions can potentially gain unauthorized access to sensitive or private information stored within nested article structures.\nThe risk implication is high, as it facilitates the exfiltration of restricted data by internal actors or compromised accounts. Successful exploitation requires the attacker to possess existing editorial access, making this a vertical privilege escalation and broken access control scenario. No specific complex exploit chains are required, as the vulnerability lies in the server-side validation logic governing the visibility inheritance and permission enforcement for parent-child article relationships.\nOrganizations using affected versions of YouTrack are susceptible to unauthorized data exposure and should prioritize upgrading to the patched version to restore proper permission hierarchy enforcement.",
  "technicalDetails": "The vulnerability resides within the article management module of JetBrains YouTrack, specifically in the logic responsible for handling visibility permissions and inheritance for nested document hierarchies. The root cause is an insufficient server-side validation mechanism that fails to re-verify authorization constraints when an authenticated user modifies the access control lists (ACLs) or visibility scope of child articles.\nIn YouTrack, articles can be organized in a parent-child structure. The application is designed to respect defined visibility restrictions, ensuring that restricted articles remain inaccessible to unauthorized users. However, in the affected versions, the application logic incorrectly trusts the client-side request when an editor modifies a child article. Specifically, the backend fails to validate whether the current user has the appropriate global or parent-level permissions to alter the visibility state of an object that is inherited or restricted.\nThe attack flow proceeds as follows: 1) The attacker authenticates to the YouTrack instance and navigates to an article they have edit access to, which acts as a parent to a restricted child article. 2) The attacker interacts with the article editor interface, specifically targeting the configuration settings of the child article. 3) By manipulating the API request—or in some cases, through the standard UI if the validation logic is bypassed—the attacker submits a request to modify the visibility properties of the restricted child article. 4) The application, failing to perform a check against the effective permissions of the restricted child, updates the visibility metadata, effectively 'lifting' the restriction or granting access to the attacker or unauthorized groups.\nThis vulnerability is an instance of CWE-285 (Improper Authorization) and CWE-269 (Improper Privilege Management). The affected component is the article permission-handling controller, which lacks granular checks on sub-article operations. Because the validation logic relies on the context of the user's role without verifying the specific resource's sensitivity, the system permits an authorized editor to override access controls on child nodes. Post-exploitation impact includes unauthorized information disclosure and the potential compromise of knowledge management confidentiality. The exposure is internal to the application's authenticated session, requiring a valid account with editorial privileges, but the impact is significant due to the bypass of administrative visibility controls."
}