Description

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-07T17:17:26.270Z",
  "pubdate": "2026-09-07T17:17:26.270Z",
  "executiveSummary": "This vulnerability involves an improper authorization flaw within JetBrains YouTrack, specifically related to the handling of signed URLs used for project icons.\nThe vulnerability allows for the unauthorized disclosure of restricted project icons due to the reuse of signed URLs that should have been scoped or time-limited to prevent unauthorized access.\nThe flaw affects YouTrack versions prior to 2026.2.18634.\nImpact includes the exposure of potentially sensitive organizational branding or project-related metadata that was intended to be restricted to authorized users only.\nExploitation does not require elevated privileges, as it leverages the predictable or reusable nature of the signed URL mechanism.\nAttackers can leverage this to gain unauthorized visibility into project structures by harvesting icon assets without direct access to the underlying project permissions.",
  "technicalDetails": "The vulnerability resides in the YouTrack mechanism responsible for generating and validating signed URLs for static project assets, specifically icons.\nSigned URLs are typically designed to provide temporary, secure access to restricted resources by embedding a cryptographic signature within the request parameters. This signature, when validated by the backend, confirms that the user has the necessary permissions to access the specified resource.\nIn the vulnerable implementation, the system failed to adequately enforce the single-use nature or strict temporal constraints of these signed URLs. By reusing a previously generated signed URL, an attacker can bypass the backend authorization checks that are normally triggered when requesting these assets via standard session-based requests.\nThe attack flow proceeds as follows: 1) An attacker obtains a legitimate signed URL, potentially through initial interaction with the application or via intercepted traffic where such URLs are exposed. 2) The attacker then replays this signed URL to request the resource directly, even if the user session associated with the initial generation has expired or if the attacker lacks the specific project permissions required to view the asset in a standard context. 3) The backend server, failing to invalidate the token post-usage or ignoring the temporal window, incorrectly validates the signature and serves the restricted project icon.\nThis bypasses the intended security boundary established by the Access Control List (ACL) system within YouTrack. Since project icons can occasionally convey sensitive information—such as internal project naming conventions, branding associated with confidential initiatives, or organizational hierarchies—the disclosure constitutes a breach of information security policy.\nThe root cause is the flawed validation logic in the signed URL handling routine, which lacks sufficient entropy or state management to prevent replay attacks. Because the signed URL tokens are not cryptographically bound to a unique request context or session identity, they essentially function as static bypass tokens. This flaw persists across all YouTrack instances prior to the fixed version 2026.2.18634, necessitating an immediate upgrade to patch the underlying validation logic."
}