Description

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-17T16:17:51.530Z",
  "pubdate": "2026-08-17T16:17:51.530Z",
  "executiveSummary": "An unauthenticated database backup download vulnerability exists in JetBrains YouTrack before versions 2025.3.156085, 2026.1.13913, and 2026.2.18112.\nThe vulnerability allows remote, unauthenticated attackers to unauthorizedly download sensitive database backup archives by leveraging shared draft signatures.\nSuccessful exploitation compromises the confidentiality of the entire application database, potentially exposing proprietary data, internal communications, user credentials, and sensitive metadata stored within the YouTrack instance.\nThe risk implication is critical due to the exposure of core database assets without requiring prior authentication, valid session tokens, or specialized user privileges.\nAttacker capabilities include the unauthorized retrieval of comprehensive application state data, facilitating offline analysis and further compromise.\nExploitation requirements are limited to network accessibility to the vulnerable YouTrack instance and the ability to craft or exploit shared draft signature mechanics to retrieve the restricted backup files.",
  "technicalDetails": "The vulnerability resides within the backup management and sharing mechanisms of JetBrains YouTrack, specifically concerning how draft signatures are processed and validated.\nAffected versions include JetBrains YouTrack prior to 2025.3.156085, 2026.1.13913, and 2026.2.18112.\nThe root cause stems from an authorization bypass and insufficient cryptographic validation of shared draft signatures associated with backup generation and retrieval functions.\nAuthentication and privilege requirements are entirely absent; an unauthenticated network attacker can interact with the vulnerable endpoint.\nNetwork exposure is present wherever the YouTrack web interface or application API is reachable by untrusted networks, such as the internet.\nThe attack flow proceeds as follows: First, the attacker identifies or interacts with the endpoint responsible for handling shared draft signatures or backup retrieval. Second, by exploiting the flawed validation logic, the attacker supplies or crafts a valid signature context. Third, the application processes the request without enforcing proper access control checks or validating whether the requesting entity holds administrative privileges. Finally, the server streams the underlying database backup file directly to the attacker.\nThe payload behavior involves requesting sensitive backup archives through unauthorized HTTP/HTTPS transactions.\nThe post-exploitation impact includes complete loss of data confidentiality, as the database backup contains extensive application artifacts that can be parsed offline to harvest credentials, session identifiers, and confidential project data."
}