Description

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T16:17:51.647Z",
  "pubdate": "2026-08-17T16:17:51.647Z",
  "executiveSummary": "An account enumeration vulnerability exists in JetBrains YouTrack before 2026.2.18112.\nThis vulnerability allows an authenticated user to systematically enumerate valid user accounts within the application.\nThe primary impact of this flaw is the exposure of sensitive user metadata and valid account identities, which can facilitate subsequent targeted attacks such as credential stuffing, brute-force attacks, or social engineering campaigns.\nThe affected system is JetBrains YouTrack, specifically installations running versions prior to 2026.2.18112.\nThe risk implication is moderate, representing a breach of user privacy and a foundational step for advanced reconnaissance.\nThe capability required by an attacker is authenticated access to the application, meaning the adversary must possess valid credentials or an active session within the environment.\nNo specific elevated privileges are mentioned as necessary beyond standard authentication, and exploitation relies on interacting with the vulnerable endpoint to observe disparate server responses indicative of account validity.",
  "technicalDetails": "The vulnerability resides within the users search endpoint of JetBrains YouTrack, which fails to adequately restrict or obfuscate user existence checks for authenticated clients.\nThe root cause stems from improper authorization checks, lack of rate limiting, or differential response behavior when querying the user directory, enabling callers to distinguish between valid and invalid account identifiers.\nThe affected component is the user search and retrieval subsystem in JetBrains YouTrack versions prior to 2026.2.18112.\nExploitation requires network exposure to the YouTrack instance and an active authenticated session.\nThe attack flow proceeds as follows: First, the authenticated attacker formulates a series of automated queries directed at the users search endpoint, injecting candidate usernames, email addresses, or internal identifiers into the request parameters.\nSecond, the application processes these search queries against the underlying database or user directory.\nThird, due to insufficient input validation or insecure direct object reference handling, the application returns distinct response structures, status codes, or execution times for queries matching existing accounts compared to non-existent ones.\nFourth, the attacker parses the responses to compile a definitive list of valid user accounts.\nPost-exploitation impact includes the aggregation of target profiles, which can be leveraged to execute targeted credential attacks or mount further unauthorized reconnaissance against the application infrastructure."
}