Description

In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-07T17:17:28.220Z",
  "pubdate": "2026-09-07T17:17:28.220Z",
  "executiveSummary": "A broken access control vulnerability exists in JetBrains YouTrack, specifically concerning the handling of PUT requests on link sub-resources.\nThe vulnerability allows an authenticated user lacking the necessary update permissions to modify linked entities within the system.\nAffected versions include YouTrack iterations prior to 2025.3.160480 and 2026.1.14047.\nThe risk implication centers on unauthorized data manipulation, where attackers can alter the relationships or state of entities despite lacking explicit administrative or update privileges.\nThis flaw represents a failure in the application's authorization framework, where the API endpoint responsible for managing entity links fails to enforce permission checks during the request lifecycle.\nSuccessful exploitation requires the attacker to have at least a basic level of authentication within the environment, though they do not need elevated privileges to perform the malicious link modification.",
  "technicalDetails": "The vulnerability stems from improper access control validation within the API layer handling resource links. In the affected versions of JetBrains YouTrack, the application logic governing PUT requests directed at link sub-resources failed to adequately verify whether the authenticated user possessed the 'update' permission for the associated entities.\nWhen an HTTP PUT request is initiated to modify a link between two YouTrack entities, the backend service processes the payload to update the reference metadata. Due to an oversight in the authorization check implementation, the system only performed a cursory verification rather than a granular permission assessment against the specific target entities.\nThe attack flow proceeds as follows: 1) The attacker authenticates as a standard user with restricted permissions; 2) The attacker identifies the endpoint associated with link sub-resources; 3) The attacker crafts a malicious PUT request, specifying the link modification parameters; 4) The application processes the request, bypassing the security policy that should have blocked the operation; 5) The linked entities are modified in the backend database without authorized validation.\nThe vulnerable component resides within the API endpoint handlers responsible for entity association and link management. By exploiting this flaw, an attacker can effectively modify the structure, dependency chains, or relational attributes of issues, tickets, or other linked objects within the YouTrack ecosystem.\nPost-exploitation impact includes integrity compromise of project management data, potential workflow disruption, and the ability to associate entities in ways that contradict organizational access policies. Because the PUT request is processed as a legitimate transaction, the modification is persisted globally, potentially affecting the integrity of audit trails or automated reporting metrics dependent on link configurations.\nThe deficiency is essentially a lack of enforcement for the 'update' privilege when interacting with sub-resource endpoints, rendering the server-side access control mechanisms ineffective against specifically formatted HTTP PUT operations."
}