Description

In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-11-06T11:17:13.587Z",
  "pubdate": "2026-11-06T11:17:13.587Z",
  "executiveSummary": "A missing authorization vulnerability exists in JetBrains YouTrack versions prior to 2026.2.19562, specifically impacting the management of Version Control System (VCS) hosting server configurations.\nThis flaw allows users assigned the Project Admin role to perform administrative actions on VCS integrations that should be restricted to System Administrators.\nThe vulnerability represents a significant security risk, as it enables unauthorized modification of sensitive infrastructure components used for code repository synchronization and integration.\nBy bypassing role-based access control (RBAC) mechanisms, an attacker with Project Admin privileges can manipulate external VCS server settings, potentially leading to unauthorized data exposure, service disruption, or the redirection of authentication tokens and repository traffic.\nExploitation does not require elevated system-level privileges beyond the existing Project Admin role, making this a critical concern for environments where project-level authority is delegated to untrusted or less-privileged users.",
  "technicalDetails": "The vulnerability resides in the access control layer governing VCS hosting configurations within JetBrains YouTrack. Specifically, the application failed to implement robust authorization checks on API endpoints or UI components responsible for defining, updating, or deleting VCS server connection parameters.\nThe root cause is an improper implementation of permission validation logic within the administrative module. While the system correctly identifies the user as a 'Project Admin,' the underlying backend service fails to enforce the 'System Administrator' requirement for sensitive VCS server configuration endpoints.\nUnder normal circumstances, only users with global System Administrator privileges should have the authority to manage VCS hosting infrastructure, as these settings often involve credentials, API keys, or security certificates for external repository services.\nThe attack flow involves a user with Project Admin privileges interacting with the VCS hosting management interface. Upon navigating to the configuration settings for VCS servers, the application permits the user to modify existing server definitions. An attacker can leverage this to change the target URL of a VCS server to an attacker-controlled infrastructure, potentially capturing authentication headers or sensitive repository metadata during subsequent synchronization events.\nThe exploitation path is straightforward and does not require complex binary manipulation or exploit chains. Since the application logic inherently trusts the request originating from a Project Admin, the backend processes the changes without verifying global administrative rights. This results in an insecure state where configuration integrity is compromised.\nThe impact of this vulnerability is severe in the context of supply chain security. By manipulating VCS hosting configurations, an adversary could facilitate a man-in-the-middle (MitM) scenario for repository traffic, or force the application to use malicious credentials storage settings. The scope of the vulnerability includes all YouTrack instances prior to the 2026.2.19562 release.\nSuccessful exploitation results in unauthorized modification of global settings, bypassing the principle of least privilege. This can lead to persistent backdooring of integration flows or the exfiltration of repository-related credentials stored within the YouTrack configuration database."
}