Description

In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-07T17:17:28.330Z",
  "pubdate": "2026-09-07T17:17:28.330Z",
  "executiveSummary": "This vulnerability is an Improper Authorization flaw identified in JetBrains YouTrack, specifically concerning the exposure of internal group metadata through predefined search fields.\nThe vulnerability allows unprivileged users to enumerate all group names defined within the system, regardless of configured visibility permissions or access control lists.\nThe impact involves the unauthorized disclosure of sensitive organizational information, which can assist attackers in performing reconnaissance for further targeted attacks, such as social engineering or privilege escalation attempts against specific internal groups.\nThe vulnerability affects all versions of JetBrains YouTrack prior to 2026.1.14047. Exploitation does not require elevated privileges, meaning any authenticated user in the environment can trigger the information leak by interacting with the predefined search field interface.\nThe root cause lies in a failure of the application's backend to apply granular authorization checks when processing requests for predefined search parameters, leading to the exposure of data that should be restricted based on user roles and membership status.",
  "technicalDetails": "The vulnerability originates from an authorization bypass within the YouTrack query and search functionality. In affected versions, the predefined search fields logic fails to enforce access control checks when populating available group data for the search interface.\nUnder standard operating conditions, group visibility in YouTrack is expected to be governed by the Access Control List (ACL) attached to each project and group. Users should only be able to view groups that they have been explicitly granted permission to see or groups that are public within their scope.\nHowever, the vulnerable component responsible for populating these search fields fetches the entire catalog of group names from the underlying database or cache without validating the current user's session privileges or visibility scope.\nAn attacker can exploit this by navigating to the search input area where predefined fields are utilized. By observing the responses from the backend API, or by interacting with the auto-complete/suggestion functionality integrated with these fields, the attacker can extract a comprehensive list of all groups within the YouTrack instance.\nThe attack flow is straightforward: 1. The user initiates a search request or interacts with a UI element that triggers the autocomplete functionality associated with predefined fields. 2. The backend service retrieves all available group identifiers. 3. Due to the lack of filtering, the backend transmits the complete list of group names to the client-side interface. 4. The attacker parses this response to obtain sensitive information regarding organizational structure, department names, or security groups.\nThis behavior is highly problematic as it exposes the existence of groups intended to be hidden from regular users, potentially revealing information about security auditing teams, internal project teams, or sensitive management groups. The vulnerability does not require any specific exploit scripts, as it is a result of logic flaws in the core product code, making it readily exploitable by any standard user session.\nThe exposure of group names provides high-value reconnaissance data. Knowing the exact naming conventions or the existence of specific internal teams allows an attacker to tailor phishing campaigns or identify high-value targets for future exploitation phases.\nThis vulnerability has been remediated in version 2026.1.14047, which introduces strict authorization filtering on the backend before the metadata is serialized and sent to the client."
}