Description

In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-07T17:17:27.987Z",
  "pubdate": "2026-09-07T17:17:27.987Z",
  "executiveSummary": "This vulnerability involves a critical access control deficiency within the Helpdesk feature of JetBrains YouTrack. The flaw allows unauthorized users to retrieve sensitive reporter email addresses.\nThe vulnerability is categorized as an improper access control issue, which facilitates unauthorized data exposure. It specifically impacts the confidentiality of user information within the Helpdesk module.\nThe affected product is JetBrains YouTrack, specifically versions prior to 2026.2.18769. The risk implication involves the potential for attackers to harvest Personally Identifiable Information (PII) of ticket reporters, which could be leveraged for targeted phishing, social engineering, or further reconnaissance campaigns.\nExploitation does not appear to require high-level administrative privileges; however, it necessitates an attacker to interact with the Helpdesk reporting interface or its associated API endpoints to trigger the information leak.\nThis vulnerability highlights a failure in the application's authorization logic, where the system fails to validate whether an authenticated user possesses the appropriate permissions to view the contact details of Helpdesk reporters.",
  "technicalDetails": "The vulnerability resides within the access control layer of the JetBrains YouTrack Helpdesk module. The root cause is a failure to properly implement authorization checks when processing requests for Helpdesk reporter data. In affected versions, the application logic fails to verify if the requester has the requisite privileges to access the email addresses of individuals who have submitted requests through the Helpdesk portal.\nThe attack flow initiates when a malicious or unauthorized actor makes a request to the Helpdesk endpoint designed for retrieving reporter information. Because the backend service lacks a restrictive access control list (ACL) or attribute-based access control (ABAC) mechanism at the object level, the application processes the request and returns the sensitive metadata associated with the reporter.\nSpecifically, the vulnerable component is the Helpdesk reporting interface, which acts as the conduit for exposure. An attacker can systematically enumerate or directly query for email addresses by interacting with the product's internal API, which handles the retrieval of Helpdesk tickets and their associated reporter entities. The vulnerability bypasses intended privacy protections, allowing unauthorized actors to perform reconnaissance on the user base of the Helpdesk deployment.\nAffected versions of JetBrains YouTrack include all releases prior to 2026.2.18769. The vulnerability is present in standard installations of the software where the Helpdesk feature is active.\nThe technical requirements for exploitation are minimal, as the vulnerability resides in the core API handling of the Helpdesk module. Once an attacker successfully initiates an interaction with the API endpoint, the system erroneously exposes the reporter's PII, specifically email addresses, directly in the response payload. This data leakage occurs in cleartext, providing the attacker with actionable information about the internal or external stakeholders interacting with the Helpdesk system.\nThe post-exploitation impact includes the aggregation of user email addresses, which poses a significant risk to user privacy and organizational security. Such data harvesting can serve as a prerequisite for more sophisticated attacks, including spear-phishing, credential stuffing, or identifying targets for unauthorized communication aimed at compromising the integrity of the YouTrack instance or the wider IT environment."
}