Description

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-07T17:17:28.443Z",
  "pubdate": "2026-09-07T17:17:28.443Z",
  "executiveSummary": "A critical security vulnerability has been identified in JetBrains YouTrack versions prior to 2026.1.14047, characterized as an improper authorization flaw. The vulnerability arises from an insufficient escalation check during project management operations, allowing a user possessing standard project update permissions to unilaterally elevate their own privileges to the level of Project Admin.\nThis flaw represents a significant risk to organizational data integrity and confidentiality, as it bypasses established role-based access control (RBAC) mechanisms. An authenticated attacker can exploit this condition to gain administrative control over specific projects, potentially leading to unauthorized data exfiltration, project configuration tampering, or the modification of sensitive issue metadata.\nThe vulnerability requires the attacker to possess a legitimate account with project update capabilities within the target system. No additional social engineering or external interaction is required once the attacker initiates the privilege modification request. Organizations running affected versions are at risk of internal privilege abuse and should prioritize remediation to maintain secure project administration boundaries.",
  "technicalDetails": "The root cause of this vulnerability lies in a flaw within the authorization logic governing project administrative role assignments. When a user with project update permissions attempts to modify project settings or access management configurations, the underlying application logic fails to perform a secondary validation check to ensure the requester possesses the necessary administrative authorization required for role modification.\nSpecifically, the vulnerability exists within the back-end component responsible for processing project-level role assignment requests. The application correctly verifies that the user has the 'update' permission, but it fails to enforce a restriction or a 'can_grant_role' authorization check before committing changes to the project's access control list (ACL).\nThe exploitation flow proceeds as follows: 1) The attacker authenticates as a user with existing project update permissions. 2) The attacker navigates to the project management interface or interacts with the corresponding internal API endpoint responsible for managing user roles. 3) The attacker submits a malformed or unauthorized request to the endpoint, which includes their own user identifier (or the identifier of an account under their control) within the payload, attempting to assign the 'Project Admin' role. 4) The server-side component processes the request, verifying the attacker's update permission, but omitting the specific escalation check required to prevent self-assignment of administrative roles. 5) The application updates the database to reflect the elevated role, granting the attacker full administrative access to the project.\nThis behavior constitutes a vertical privilege escalation. Because the vulnerability resides in the core authorization middleware, it is agnostic to the UI layer and can be triggered via direct API interaction. The lack of proper validation on the server side allows the transaction to complete, effectively bypassing the integrity constraints intended for role delegation. The impact is persistent, meaning the elevated privileges remain active until manually revoked by a legitimate system administrator, enabling the attacker to continue performing unauthorized actions such as deleting projects, modifying global project settings, or altering the permissions of other project users."
}