Description

In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.8",
  "pubDate": "2026-11-06T11:17:13.853Z",
  "pubdate": "2026-11-06T11:17:13.853Z",
  "executiveSummary": "A critical authorization vulnerability exists in JetBrains YouTrack versions prior to 2026.2.19562 involving Version Control System (VCS) integrations.\nThe flaw stems from an improper access control validation where project administrators can perform administrative actions on resources belonging to projects outside their authorized scope.\nSpecifically, an attacker with project administrator privileges for one project can delete VCS integrations owned by a different, unrelated project.\nThis vulnerability compromises the integrity of integrated workflows and dependency tracking within the application.\nThe impact includes unauthorized modification of project configuration data, potential disruption of CI/CD pipelines linked to VCS hooks, and loss of synchronization between the bug tracker and repository metadata.\nExploitation requires the attacker to possess authenticated administrative privileges for at least one project within the YouTrack instance.\nSuccessful exploitation allows for the removal of integrations that the attacker should not have the permissions to modify, leading to significant administrative privilege escalation and operational impact on target projects.",
  "technicalDetails": "The vulnerability is classified as an authorization bypass resulting from insufficient verification of resource ownership during the API request lifecycle.\nIn the affected JetBrains YouTrack versions, the access control logic responsible for validating administrative actions fails to verify if the project administrator has the necessary scope to manipulate a specific VCS integration resource.\nWhen a project administrator initiates a delete request for a VCS integration via the backend API or management interface, the server-side code identifies that the user has administrative privileges but fails to cross-reference the target VCS integration ID with the list of projects authorized for that user.\nThe root cause lies in a logic error within the backend service handling administrative operations, where the authorization check is performed against a generic administrative permission set rather than a resource-specific scope.\nThe attack flow proceeds as follows: 1) The authenticated attacker identifies the ID of an arbitrary VCS integration that is associated with a different project. 2) The attacker submits a DELETE request to the vulnerable API endpoint responsible for VCS integration management. 3) The backend receives the request and confirms the attacker has the administrative role in the system. 4) Due to the lack of ownership validation, the system executes the command, permanently deleting the integration belonging to the victim project.\nThis behavior persists across all versions prior to 2026.2.19562. The consequence of this vulnerability is the unauthorized removal of external repository hooks and integration configurations. Post-exploitation impact involves the immediate cessation of automated issue-to-commit linking, breakage of branch tracking functionality, and potential data synchronization failures that could require manual intervention by higher-level global administrators to restore service continuity.\nThe vulnerability does not require remote code execution capabilities but leverages a flaw in the application's internal security architecture, effectively bypassing the principle of least privilege within the YouTrack multi-tenancy project model."
}