Description

In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.8",
  "pubDate": "2026-11-06T11:17:13.720Z",
  "pubdate": "2026-11-06T11:17:13.720Z",
  "executiveSummary": "JetBrains YouTrack versions prior to 2026.2.19562 contain an improper access control vulnerability within the sprint management functionality.\nThe vulnerability permits authenticated users to bypass project-level permission boundaries by reassigning issues from projects they cannot access into a target sprint they have authorization to manage.\nThis flaw allows for unauthorized information disclosure or project management manipulation, as issues containing sensitive metadata or content from restricted projects become accessible within the context of the target sprint's dashboard and reporting tools.\nAn attacker must possess authenticated access to the application and sufficient privileges to create or modify sprints within a project they are authorized to access.\nThe risk implication is a potential breach of organizational access controls, enabling the exposure of internal workflows, issue statuses, or data previously shielded by project-level visibility constraints.",
  "technicalDetails": "The vulnerability resides in the backend logic governing the reassignment of issue entities during sprint management operations. Specifically, the sprint creation and issue-association process fails to perform a rigorous authorization check against the source project of the issue being moved.\nUnder normal operating conditions, YouTrack enforces strict visibility rules where users can only interact with issues and projects for which they hold explicit 'Read' or 'Update' permissions. The identified vulnerability constitutes a broken access control flaw where the server-side controller allows the inclusion of arbitrary issue identifiers in a sprint modification request without validating the user's rights to the source project container.\nThe attack flow proceeds as follows: First, an authenticated attacker identifies the issue ID belonging to a restricted project. Even if the user cannot navigate to the restricted project or view its contents via standard search, if the ID is known or discoverable, the attacker can submit a crafted request to the sprint management endpoint (e.g., during sprint creation or editing).\nWhen the attacker submits the payload to associate the target sprint with the forbidden issue, the application's backend processes the association request without verifying if the user has sufficient permissions for the source project. Consequently, the issue is successfully mapped to the sprint. Once associated, the restricted issue becomes visible to any user or system process authorized to view the target sprint, effectively bypassing the project-level access control list (ACL).\nThis flaw suggests a missing authorization check in the API service responsible for managing sprint-to-issue links. The exposure is limited to authenticated users, but it fundamentally violates the Principle of Least Privilege by allowing users to bridge access boundaries between isolated project environments. Post-exploitation, an attacker can extract data from the restricted issues, observe confidential development velocity, or disrupt project planning by manipulating the sprint contents of an unauthorized project."
}