Description

In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-07T17:17:27.167Z",
  "pubdate": "2026-09-07T17:17:27.167Z",
  "executiveSummary": "A critical Insecure Direct Object Reference (IDOR) vulnerability exists in the user profile API of JetBrains YouTrack prior to version 2026.2.18634.\nThe vulnerability allows an authenticated attacker to bypass authorization controls, leading to the unauthorized disclosure of sensitive information.\nImpacted data includes private issues and starred folders across different organizations within the YouTrack environment.\nThe flaw stems from a failure in the API to properly validate user permissions when handling requests directed at specific profile-related endpoints.\nThis vulnerability poses a significant risk to organizational data confidentiality, as it permits lateral access to private project data and user-specific configurations that should remain restricted to authorized personnel.\nExploitation requires an authenticated session, though the attacker does not need administrative privileges, enabling a malicious user to access information belonging to other users or organizations.",
  "technicalDetails": "The vulnerability is an Insecure Direct Object Reference (IDOR) located within the user profile API of JetBrains YouTrack.\nRoot cause analysis indicates that the application's authorization logic fails to perform adequate access control checks when processing requests aimed at fetching profile-associated data, such as starred folders and private issue lists.\nThe affected component is the internal API responsible for managing and serving user profile resources. In vulnerable versions, the API endpoints do not verify whether the requesting user possesses the necessary privileges to access the resources identified by the object reference parameters in the URI or payload.\nThe attack flow involves an authenticated user manipulating object identifiers within API requests. By modifying these identifiers (e.g., changing a user ID or folder ID parameter), an attacker can coerce the API into returning unauthorized responses.\nWhen a request is submitted, the API fails to validate if the authenticated session token correlates with the entity being queried, allowing the attacker to retrieve data that is logically segregated or intended for private viewing only.\nThis vulnerability enables the unauthorized disclosure of private issue tracking information and organization-specific metadata, such as starred folder structures.\nSince the vulnerability resides in the backend API logic, it is accessible through any interface that interacts with the user profile endpoints. The exploit does not require elevated administrative roles; any standard authenticated user session can be leveraged to query the API for prohibited data.\nPost-exploitation, the attacker gains visibility into sensitive project data, potentially mapping out organizational workflows, identifying private issue statuses, or accessing proprietary project configurations that were never intended for disclosure to unauthorized entities.\nThe issue persists until the application logic is updated to enforce strict resource-level authorization checks, ensuring that every API request verifies the caller's permission set against the requested resource ownership before returning any data."
}