Description

In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-07T17:17:28.097Z",
  "pubdate": "2026-09-07T17:17:28.097Z",
  "executiveSummary": "A credential exposure vulnerability exists in JetBrains YouTrack versions prior to 2026.2.18769, stemming from insecure handling of mailbox configuration updates.\nThe vulnerability is classified as an improper authentication/authorization flaw that enables a project administrator to exfiltrate stored sensitive mailbox credentials.\nBy modifying the mailbox host configuration without requiring a re-authentication handshake, an attacker with project-level administrative privileges can redirect the credential-validation request to an attacker-controlled endpoint.\nThis allows the attacker to capture the stored credentials (such as service account tokens or passwords) during the automated authentication process.\nThe impact is significant, as it leads to the compromise of external mail server accounts integrated with the YouTrack instance, potentially providing unauthorized access to enterprise email systems.\nExploitation requires the attacker to possess project administrator privileges within the YouTrack environment. No specific external network exposure is required beyond the attacker's ability to manipulate local project settings.\nThe risk implication is a compromise of the trust boundary between YouTrack and connected mail servers, necessitating immediate updates and auditing of existing mailbox integrations.",
  "technicalDetails": "The vulnerability resides within the YouTrack mailbox integration configuration module, specifically in the logic handling the modification of host connectivity parameters. In affected versions, the application fails to enforce a security re-validation or re-authentication policy when a project administrator alters the mailbox host address.\nThe root cause is an insecure state management mechanism that permits the transition of a configured mail integration to a new host destination without invalidating the existing, stored sensitive credentials. When a project administrator updates the SMTP or IMAP/POP3 host configuration, the backend service attempts to verify the new connection using the previously cached credentials stored in the application database.\nThe attack flow proceeds as follows: 1) The attacker, authenticated as a project administrator, navigates to the mailbox integration settings for a project under their control. 2) The attacker modifies the existing mailbox host URL to point to an infrastructure under their direct control (e.g., an attacker-managed server listening on the relevant mail protocol ports). 3) Upon saving the configuration, the YouTrack backend service initiates a connectivity check to the newly defined malicious host. 4) The application transmits the stored, plaintext or decrypted credentials to the attacker-controlled server as part of the standard authentication handshake. 5) The attacker captures these credentials from the incoming traffic logs at their malicious endpoint.\nThe vulnerable component is the mailbox integration configuration service responsible for persistence and connectivity testing. Because the system does not force a clear-text re-entry of the password or a token refresh upon host modification, the credentials remain valid for use against the attacker's endpoint. This allows for persistent exfiltration whenever the system attempts to sync or validate the connection.\nThis vulnerability is restricted to versions prior to 2026.2.18769. Privilege requirements are limited to project administrator roles, which are sufficient to modify these specific project-level integrations. No specialized network exploit tools are required; the attacker merely needs a reachable listener capable of accepting the protocol-specific authentication attempt. Post-exploitation, the attacker possesses valid credentials for the integrated mailbox, enabling further reconnaissance, unauthorized access to email data, or internal phishing campaigns leveraging the legitimate, compromised service account."
}