Description

In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-07T17:17:27.867Z",
  "pubdate": "2026-09-07T17:17:27.867Z",
  "executiveSummary": "A broken access control vulnerability exists in JetBrains YouTrack versions prior to 2026.2.18687.\nThe vulnerability involves a failure to properly validate user permissions when performing write operations within the Knowledge Base component.\nThis flaw allows an authenticated attacker to create knowledge base articles in projects for which they lack the necessary access rights or visibility permissions.\nThe risk implication centers on unauthorized information disclosure, data integrity compromise, and potential unauthorized information hoarding within restricted project scopes.\nAn attacker requires authenticated access to the YouTrack instance to exploit this deficiency, but they do not need administrative or project-specific write privileges for the target project.\nBy bypassing the intended authorization gate, attackers can manipulate project content, potentially injecting malicious data or gaining unauthorized insights into sensitive organizational knowledge structures.",
  "technicalDetails": "The vulnerability originates from a deficiency in the backend authorization logic responsible for mediating requests directed at the Knowledge Base article creation endpoint in JetBrains YouTrack.\nIn affected versions, the application fails to verify the requester's 'Create article' permission against the specific security context of the target project during the article initialization sequence.\nThe root cause is an improper enforcement of project-level access control lists (ACLs) during API request handling. When a user submits a request to instantiate a new article, the server-side controller fails to perform a secondary validation check to ensure that the user's role grants them write capabilities specifically within the destination project namespace.\nThe attack flow proceeds as follows: An authenticated user identifies a target project identifier for which they are not authorized. The user interacts with the API endpoint responsible for article creation, crafting a POST request containing the target project ID. Because the application logic relies on client-side state or inadequately validated session context rather than a server-side authorization check, the request is processed successfully by the backend.\nThe vulnerable component is the Knowledge Base service module. This component incorrectly assumes that if a user has access to the general Knowledge Base interface, they possess global or project-specific authority to create content across any project identifier provided in the request payload.\nThis flaw effectively bypasses the Principle of Least Privilege, as the application fails to distinguish between projects the user is entitled to modify and projects that should remain read-only or entirely inaccessible to the user.\nThe impact post-exploitation includes the unauthorized population of sensitive project knowledge bases with arbitrary content. Depending on the organization's workflows, this could be leveraged to poison project documentation, perform cross-site scripting (XSS) if input sanitization is also lacking, or facilitate internal reconnaissance by monitoring how the system handles the unauthorized content injection.\nThe issue is present in all JetBrains YouTrack versions prior to 2026.2.18687 and requires the attacker to hold at least a basic authenticated user session on the affected instance."
}