Description

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-07T17:17:26.040Z",
  "pubdate": "2026-09-07T17:17:26.040Z",
  "executiveSummary": "JetBrains YouTrack versions prior to 2026.2.18788, 2026.1.14055, and 2025.3.161254 contain a critical authorization flaw.\nThe vulnerability is identified as an Insecure Direct Object Reference (IDOR), which allows unauthenticated or unauthorized users to interact with sensitive REST API endpoints.\nThis flaw enables unauthorized parties to bypass intended access control mechanisms, potentially exposing private project data, issue details, or administrative configurations.\nThe impact is significant, as it permits lateral movement or information disclosure within the YouTrack environment without requiring valid credentials or elevated privileges.\nThe vulnerability stems from improper validation of authorization tokens or lack of resource-level permission checks within the API layer.\nAttackers can leverage this by manipulating object identifiers in API requests, leading to unauthorized access to restricted backend resources.\nImmediate remediation is required through patching to the specified secure versions to prevent data leakage and system compromise.",
  "technicalDetails": "The vulnerability resides in the REST API request handling logic of JetBrains YouTrack, specifically concerning the enforcement of authorization checks when processing requests for restricted resources.\nThe root cause is an Insecure Direct Object Reference (IDOR) flaw, where the application fails to verify whether the requesting user possesses the requisite permissions to access a specific object identified by its primary key or unique identifier in the API endpoint URL.\nWhen a client performs a request to the YouTrack REST API, the application processes the target resource ID provided in the URI without verifying that the requester's security context (or lack thereof) is mapped to that specific resource in the database.\nThe attack flow proceeds as follows: 1) An attacker identifies accessible REST API endpoints that accept object parameters (e.g., issue IDs, project IDs, or user metadata). 2) The attacker enumerates or guesses resource identifiers. 3) The attacker crafts an HTTP request, such as a GET, POST, or DELETE operation, targeting these endpoints with unauthorized identifiers. 4) The backend application processes the request, bypassing the security policy because the function responsible for authorization fails to intercept the call.\nBecause the vulnerability is located within the API abstraction layer, the attack does not require complex payload injection techniques like SQL injection or Cross-Site Scripting (XSS). Instead, it relies on the predictable structure of the RESTful API and the application's failure to enforce authorization context for each object interaction.\nAffected versions include any deployment of YouTrack prior to 2026.2.18788, 2026.1.14055, and 2025.3.161254. The vulnerability is exploitable over the network, making any internet-facing YouTrack instance highly susceptible to automated scraping or unauthorized administrative manipulation.\nPost-exploitation impact includes the full disclosure of sensitive issue tracking data, potential modification of project states, and unauthorized extraction of system metadata. In environments where the API is integrated with third-party automation or CI/CD pipelines, this IDOR could facilitate further escalation by leaking API keys or credentials embedded within project objects."
}