Description

In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-17T16:17:52.213Z",
  "pubdate": "2026-08-17T16:17:52.213Z",
  "executiveSummary": "A severe access control vulnerability has been identified in JetBrains YouTrack prior to version 2026.2.17917, specifically concerning administrative project management functionalities. The flaw allows unauthorized users to execute project transfers between distinct organizations without possessing the requisite administrative privileges or explicit authorization. This vulnerability compromises multi-tenant isolation boundaries within the application, enabling threat actors to misappropriate, relocate, or disrupt project ownership across organizational domains. The business impact includes severe data governance violations, potential exposure of sensitive intellectual property, and unauthorized cross-organizational data migration. Exploitation of this security defect requires access to the YouTrack instance and leverages improper authorization checks within the application logic governing project migration workflows. The risk implications are particularly critical for enterprise environments hosting multiple independent organizations or clients on a single YouTrack deployment, as tenant isolation guarantees are directly violated.",
  "technicalDetails": "The vulnerability resides within the project management and organization administration subsystem of JetBrains YouTrack prior to version 2026.2.17917. The root cause stems from insufficient authorization validation and access control enforcement during the project transfer execution lifecycle. Specifically, the application fails to adequately verify whether the initiating user holds administrative privileges within both the source organization and the destination organization before processing the transfer request.\nDuring a standard administrative operation, when a project transfer is requested, the internal API endpoint should validate the session context against mandatory access control lists (ACLs) associated with the target and source entities. Due to the authorization bypass flaw, the backend component processes the state change without verifying cross-organizational boundaries.\nThe attack flow proceeds as follows: an authenticated actor with standard or limited privileges interacts with the project modification interface or crafts a direct API request targeting the project transfer function. Because the backend code lacks rigorous privilege checks, the application accepts the request and reassigns the organizational association of the specified project. The vulnerable component fails to enforce the principle of least privilege, allowing unauthorized re-routing of project assets.\nAffected versions encompass all JetBrains YouTrack installations prior to 2026.2.17917. The vulnerability is exploitable by authenticated users who can interact with the application interface or API. The post-exploitation impact includes unauthorized acquisition of project control, potential data exfiltration via migration to attacker-controlled organizations, and persistent disruption of organizational hierarchies."
}