Description

In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-11-06T11:17:13.987Z",
  "pubdate": "2026-11-06T11:17:13.987Z",
  "executiveSummary": "This vulnerability involves a missing authorization check within JetBrains YouTrack, categorized as a Broken Access Control issue.\nThe flaw allows unauthorized users to attach arbitrary tags to any issue within the system by interacting with the tag issues collection endpoint.\nThe vulnerability affects JetBrains YouTrack versions prior to 2026.2.19562, 2026.1.14137, and 2025.3.169041.\nImpact includes unauthorized modification of issue metadata, which can be leveraged to disrupt workflow organization, bypass project-specific tagging restrictions, or manipulate data reporting.\nThis exploitation requires authenticated access to the application, but does not necessitate elevated administrative privileges, as the authorization check is entirely omitted for the affected API operation.\nThe lack of robust access control checks on the tagging API creates significant integrity risks for issue tracking datasets.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper implementation of authorization controls within the YouTrack API infrastructure, specifically concerning the endpoint responsible for managing issue tag associations.\nDuring the processing of requests directed toward the tag issues collection, the application fails to validate whether the authenticated user possesses the appropriate permissions to modify tags on a target issue.\nBecause the server-side logic lacks an effective access control list (ACL) check or policy validation at the controller or service layer for this specific action, the system processes tag modification requests regardless of the user's role or project membership.\nThe attack flow begins when an attacker identifies the relevant REST API endpoint for updating the tags collection associated with a specific issue identifier. By sending a crafted POST or PUT request, an attacker can supply unauthorized tag IDs to be appended to any issue they can reference within the YouTrack instance.\nThe vulnerable component is the tag management module, which fails to enforce project-level or issue-level authorization when performing batch or individual tag modifications.\nAffected versions include any deployment of YouTrack prior to 2026.2.19562, 2026.1.14137, or 2025.3.169041.\nExploitation is strictly performed via authenticated session tokens, meaning the attacker must be a registered user within the instance; however, the requirement for specific project-level access is bypassed due to the vulnerability.\nPost-exploitation impact includes the potential for tag-based information exposure if internal tags are used for sensitive labeling, the mass corruption of issue tracking workflows, or the injection of malicious metadata that could deceive automated reporting scripts or integrations that rely on tag-based triggers.\nSince the vulnerability exists at the API level, standard front-end user interface restrictions are bypassed, allowing an attacker to script large-scale tag modifications across the entire repository of issues."
}