Description

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-17T16:17:51.410Z",
  "pubdate": "2026-08-17T16:17:51.410Z",
  "executiveSummary": "An authorization bypass vulnerability exists within JetBrains YouTrack before versions 2025.3.156085, 2026.1.13914, and 2026.2.18095.\nThe flaw specifically resides in the mailbox endpoint, where inadequate access control checks fail to validate whether the requesting user possesses the necessary privileges to perform administrative or destructive actions.\nAn authenticated attacker can exploit this missing authorization flaw to delete arbitrary entities within the application.\nThe impact of successful exploitation includes unauthorized data destruction, integrity compromise, and potential service disruption across affected YouTrack instances.\nExploitation requires a valid user account on the target system to interact with the mailbox endpoint, but does not necessitate elevated administrative privileges.\nOrganizations utilizing vulnerable instances face significant risks regarding data loss and unauthorized state modification if unmitigated.",
  "technicalDetails": "The vulnerability is classified as a missing authorization issue affecting the mailbox endpoint within JetBrains YouTrack.\nThe root cause stems from a failure in the application logic to properly enforce access control lists (ACLs) and verify user permissions when processing requests directed at specific functional routes handled by the mailbox integration subsystem.\nAffected software versions include JetBrains YouTrack prior to 2025.3.156085, 2026.1.13914, and 2026.2.18095.\nTo execute an attack, an authenticated user initiates an HTTP request targeting the vulnerable mailbox endpoint.\nBecause the server-side component fails to validate the caller's authorization level against the target resource, the application processes the incoming instruction as valid.\nThe payload mechanism involves crafting specific API requests or mailbox interactions that reference arbitrary system entities intended for deletion.\nUpon receiving the request, the backend executes the deletion logic without performing contextual permission checks, resulting in the permanent removal or destruction of the targeted entities.\nThe attack vector is network-based, requiring the adversary to have low-privileged network access and a standard authenticated session within the YouTrack environment.\nNo complex exploitation chains or advanced privilege escalation techniques are required, as the vulnerability directly bypasses the intended authorization boundaries enforced elsewhere in the application architecture.\nPost-exploitation impact is characterized by unauthorized data loss, where critical project management artifacts, issues, or associated entities can be maliciously or inadvertently purged by unauthorized users."
}