CVE-2026-123296 · Infrastructure
NO FIX YET · SEE WHAT TO DO
JetBrains Hub before 2026.2.52519 let a user escalate privileges by forging an email verification. An attacker who can trigger this gains rights beyond their own account.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host JetBrains Hub for user and access management are exposed on versions before 2026.2.52519. The sources do not say which configurations or account types are needed, so treat any self-hosted Hub as in scope. Hub only running in JetBrains' hosted service is handled by the vendor.
Not affected if managed-hosting
Who cares jetbrains-hub, self-hosted
2026.2.52519; anything older is in the vulnerable range.2026.2.52519 or later.In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.