Description

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T16:17:51.987Z",
  "pubdate": "2026-08-17T16:17:51.987Z",
  "executiveSummary": "A vulnerability exists in JetBrains YouTrack prior to versions 2026.1.13903 and 2026.2.17950, allowing an authenticated user to gain unauthorized read access to restricted articles belonging to other projects. This security flaw stems from insufficient authorization checks within the draft creation endpoint, failing to properly validate whether the requesting user possesses adequate permissions to access the target project's restricted content. The risk implication is significant as it breaches confidentiality boundaries within multi-project environments, enabling lower-privileged or cross-project users to harvest sensitive organizational data stored in article drafts. Exploitation of this vulnerability requires an authenticated session on the target YouTrack instance, granting the attacker the capability to interact with the draft creation mechanism and extract unauthorized information. No complex preconditions or administrative privileges are necessary beyond standard user authentication, lowering the barrier for potential exploitation by malicious insiders or compromised accounts.",
  "technicalDetails": "The vulnerability resides within the article draft creation endpoint of JetBrains YouTrack, specifically affecting versions prior to 2026.1.13903 and 2026.2.17950. The root cause of the issue is an improper authorization enforcement flaw in the backend logic handling draft initialization and persistence. When a client initiates a request to the draft creation component, the application fails to adequately verify if the authenticated user has explicit read permissions for the specific project associated with the target resource. Consequently, the access control check evaluates user privileges too leniently or omits project-level scoping entirely during the draft instantiation phase.\nTo exploit this vulnerability, an attacker must possess a valid, authenticated user account within the target JetBrains YouTrack instance. The attack flow begins by crafting an HTTP request directed at the vulnerable draft creation endpoint. By manipulating request parameters to reference restricted articles or cross-project identifiers, the attacker bypasses standard access restrictions. Because the backend component processes the input without verifying cross-project access constraints, it instantiates or interacts with the draft and inadvertently leaks the restricted article content in the server response or permits unauthorized state manipulation. The vulnerable component processes input handling for drafts without enforcing principle-of-least-privilege access controls.\nThe network exposure is bounded by the accessibility of the YouTrack web application interface, requiring network connectivity to the instance. The post-exploitation impact is characterized by a breach of data confidentiality, allowing unauthorized retrieval of proprietary documentation, internal knowledge base drafts, and sensitive operational notes restricted to specific project teams or administrators."
}