Description

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-07T17:17:27.753Z",
  "pubdate": "2026-09-07T17:17:27.753Z",
  "executiveSummary": "This vulnerability involves an improper access control flaw within JetBrains YouTrack, specifically concerning the whiteboard cloning functionality.\nThe vulnerability allows an authenticated user to perform unauthorized modifications to links pointing to issues they are not otherwise authorized to access.\nAffected products include JetBrains YouTrack versions prior to 2026.2.18634.\nThe risk implication is a potential breach of confidentiality and integrity regarding issue metadata and cross-reference mapping within the platform.\nAn attacker must be an authenticated user of the system to initiate the whiteboard cloning process.\nSuccessful exploitation bypasses standard security boundaries that restrict visibility into inaccessible or private issue tracking entities.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient authorization check during the whiteboard cloning process within JetBrains YouTrack. When a user executes a clone operation on an existing whiteboard, the application backend fails to validate the user's permissions against the target entities referenced by links embedded within the whiteboard content.\nIn a standard deployment, YouTrack enforces strict Access Control Lists (ACLs) based on project visibility and issue-level permissions. However, the cloning workflow erroneously assumes that all linked resources within the source whiteboard are implicitly accessible to the user initiating the clone, or fails to re-validate the existence and access rights of linked issues during the duplication phase.\nThe attack flow proceeds as follows: 1) The attacker identifies a whiteboard containing links to sensitive or inaccessible issues. 2) The attacker triggers the 'clone' function on this whiteboard. 3) The backend service processes the cloning request by iterating through the whiteboard components, including links to issues. 4) Due to the flawed authorization logic, the system allows the creation of a new, cloned whiteboard instance. 5) By interacting with this new instance, the attacker is able to manipulate, modify, or potentially escalate the scope of links that point to issues for which they lack the necessary read or edit privileges.\nThe vulnerable component is identified within the whiteboard management module of the YouTrack application. Because the cloning logic fails to enforce a 'deny by default' policy regarding the resolution of linked issues during object duplication, the system creates a bridge between an authenticated user and data silos that should remain restricted.\nThis vulnerability is particularly significant as it circumvents the project-level isolation expected in multi-tenant or multi-project environments. By exploiting this, an attacker can manipulate link references that should be shielded from their view, potentially leaking internal metadata or corrupting the relational mapping of the target project's issue database. The impact is limited to the modification of the whiteboard link structures, but this provides a mechanism for unauthorized information exposure and integrity degradation of link-based interconnections within the application ecosystem."
}