Description

In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-07T17:17:27.053Z",
  "pubdate": "2026-09-07T17:17:27.053Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) vulnerability exists within JetBrains YouTrack versions prior to 2026.2.18634. The flaw resides in the 'watchRules' and 'issueListConfig' endpoints, which improperly handle authorization checks for private saved searches.\nThis vulnerability allows authenticated attackers to access sensitive data contained within private saved searches that they are not authorized to view. By manipulating requests to the specified API endpoints, an attacker can bypass access control mechanisms to retrieve configuration details and potentially sensitive search criteria from other users or restricted projects.\nThe primary risk implication is unauthorized information disclosure. While the vulnerability requires the attacker to have an existing authenticated session within the YouTrack environment, it does not require administrative privileges. Successful exploitation enables the exfiltration of private data, potentially exposing internal project structures, sensitive issue labels, or proprietary workflows to unauthorized parties.\nOrganizations using affected versions of YouTrack are susceptible to data leakage if internal users or compromised accounts perform targeted requests against these endpoints. Remediation requires an immediate upgrade to the patched version as specified by the vendor.",
  "technicalDetails": "The vulnerability is characterized as an Insecure Direct Object Reference (IDOR) occurring within the application's API layer. Specifically, the 'watchRules' and 'issueListConfig' endpoints fail to perform robust authorization validation when retrieving information regarding saved search configurations.\nThe root cause is a deficiency in the server-side access control logic. When a user requests configuration data for a saved search, the application incorrectly trusts the input parameters provided by the client without verifying the requester's permissions against the target object's ownership or sharing scope. Consequently, if an attacker provides the identifier for a private saved search, the backend service returns the object properties regardless of whether the current user has explicit permissions to access that object.\nThe exploitation flow begins with the attacker obtaining the unique identifier (ID) of a target private saved search. In many instances, these IDs may be discoverable through other predictable API responses or enumeration techniques. Once the ID is obtained, the attacker issues a crafted HTTP GET or POST request to either the '/api/watchRules' or '/api/issueListConfig' endpoints. By injecting the ID of the unauthorized resource into the request, the application retrieves the private configuration details and returns them in the HTTP response body, typically in JSON format.\nThe vulnerability affects all YouTrack versions prior to 2026.2.18634. Exploitation is restricted to the network reachability of the YouTrack instance and requires a valid user session, as the endpoints are not accessible to unauthenticated anonymous users. However, because the vulnerability does not require administrative rights, any standard user can potentially access private saved searches created by other users or administrators.\nThe impact of successful exploitation includes the unauthorized disclosure of metadata regarding private issues and saved filters. This information can reveal sensitive project naming conventions, private user activity patterns, and potentially sensitive search queries that may inadvertently expose information about the underlying database content or organizational workflows. Post-exploitation, an attacker might leverage the acquired configuration data to map internal project dependencies or identify specific high-value targets for further reconnaissance within the YouTrack instance."
}