---
id: "CVE-2026-123294"
page: "https://infrastack.ai/live/CVE-2026-123294"
kind: "vulnerability"
aliases: ["CVE-2026-123294"]
title: "JetBrains Hub: email verification flaw allows privilege escalation before 2026.2.52556"
severity: "critical"
cvss: 9.6
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["jetbrains-hub", "other", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-11-06T11:17:08+00:00"
first_seen_at: "2026-11-06T11:41:25+00:00"
updated_at: "2026-11-06T11:41:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123294", "first_seen_at": "2026-11-06T11:41:25+00:00"}]
exploit_sources: []
---

# JetBrains Hub: email verification flaw allows privilege escalation before 2026.2.52556

Link for people: https://infrastack.ai/live/CVE-2026-123294 (this .md is for agents)

JetBrains Hub, the authentication and user management service for JetBrains tools, could be abused to gain higher privileges by changing email authentication details during the verification flow. An attacker who can reach the verification flow could gain elevated access to the Hub instance.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Hub version against the fixed version in the sources (`2026.2.52556`)
- Confirm whether the Hub instance is reachable from outside your network

## Fix

- JetBrains Hub: upgrade to `2026.2.52556` or later

## Timeline

- 2026-11-06T11:41:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123294

## From the sources

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_