Description

In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-11-06T11:17:14.250Z",
  "pubdate": "2026-11-06T11:17:14.250Z",
  "executiveSummary": "A broken access control vulnerability exists in JetBrains YouTrack versions prior to 2026.2.19656, allowing unauthorized modification of issue visibility settings.\nThe vulnerability occurs due to improper authorization checks within the application's permission management logic.\nAn authenticated user who lacks the 'update' permission for a specific issue can circumvent these security controls to change visibility parameters, potentially exposing sensitive or private project data to unauthorized personnel.\nThis flaw impacts the confidentiality and integrity of issue tracking within the YouTrack environment.\nThe risk is primarily associated with information disclosure, as restricted issues can be made visible to broader groups or unauthorized users, violating the principle of least privilege.\nSuccessful exploitation requires an authenticated user account, but does not require administrative privileges or the 'update' permission normally mandated for modifying issue attributes.\nJetBrains has released security updates to address this flaw, necessitating immediate patching to ensure consistent access control enforcement across all project configurations.",
  "technicalDetails": "The vulnerability originates from a deficiency in the server-side access control validation logic responsible for processing update requests directed at issue metadata.\nIn the affected versions of JetBrains YouTrack, the application failed to sufficiently enforce permission requirements when a user initiates a request to modify the 'visibility' field of an issue.\nNormally, modifying an issue's visibility property—which determines which users or groups can view the issue—requires explicit 'update' permissions granted to the user for that specific issue or project.\nThe root cause is identified as an insecure direct object reference or a missing authorization check within the backend API handler tasked with processing visibility state transitions.\nWhen an attacker sends a crafted request to modify an issue's visibility, the backend service fails to re-verify the user's role-based access control (RBAC) credentials against the required permission set for that specific operation.\nBecause the validation check is bypassed, the application processes the request as if it originated from an authorized entity, allowing the state change to persist in the underlying database.\nExploitation flow typically follows these steps: 1) The attacker authenticates into the YouTrack instance with standard user privileges. 2) The attacker identifies a target issue that they are allowed to see but not allowed to edit. 3) The attacker intercepts or crafts a request targeting the issue update API, specifically modifying the visibility configuration payload. 4) The server receives the request, fails to perform the authorization validation on the 'visibility' update action, and updates the database record accordingly.\nThe lack of server-side validation means the integrity of visibility constraints is entirely bypassed, leading to potential unauthorized data exposure if an issue is transitioned from a restricted visibility state to a public or team-wide accessible state.\nThis vulnerability is confined to instances running versions earlier than 2026.2.19656. Post-exploitation impact includes unauthorized information disclosure and the potential for cascading data leakage if sensitive project issues are exposed to wider audiences."
}