{"id":"CVE-2026-123328","kind":"vulnerability","aliases":["CVE-2026-123328"],"related":[],"title":"JetBrains YouTrack: app permission bypass lets users escalate privileges","description":"In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab","summary":"In JetBrains YouTrack before 2026.2.19656, an app permission check could be bypassed through the project tab, letting a user gain higher privileges. An attacker who already has a YouTrack account can use this to act beyond their granted rights.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jetbrains","self-hosted","vendor","youtrack"],"not_affected_if":["already-patched"],"how_to_check":"- Check the installed YouTrack version in the admin panel or on the server, and compare it with `2026.2.19656`","fix":"- JetBrains YouTrack: `2026.2.19656`","status":"open","published_at":"2026-11-06T11:17:13+00:00","first_seen_at":"2026-11-06T11:41:27+00:00","triaged_at":"2026-11-06T11:42:18+00:00","updated_at":"2026-11-06T11:42:18+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-06T11:42:18Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains YouTrack: `2026.2.19656`","reach":"network","title":"JetBrains YouTrack: app permission bypass lets users escalate privileges","impact":"medium","summary":"In JetBrains YouTrack before 2026.2.19656, an app permission check could be bypassed through the project tab, letting a user gain higher privileges. An attacker who already has a YouTrack account can use this to act beyond their granted rights.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["youtrack","self-hosted","jetbrains"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated user gains privileges beyond their granted permissions","analyst_note":"Confirm whether JetBrains Cloud YouTrack is affected and whether any workaround exists, via the JetBrains YouTrack security advisory referenced by NVD.","how_to_check":"- Check the installed YouTrack version in the admin panel or on the server, and compare it with `2026.2.19656`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["already-patched"],"who_is_affected":"Self-hosted YouTrack installations before 2026.2.19656 are affected, since the flaw is in the app permission handling of the project tab. The sources do not say whether JetBrains Cloud-hosted YouTrack instances are affected. Teams already on 2026.2.19656 or later can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000691,"input_tokens":4168,"output_tokens":549,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123328':12A,15A '-2026':11A,14A '2026.2.19656':26B,65C 'account':51B 'act':56B 'allow':69C 'alreadi':47B 'app':3A,28B,66C 'attack':45B 'beyond':57B 'bypass':5A,33B,68C 'check':30B 'could':31B 'cve':10A,13A 'escal':8A,71C 'gain':41B 'grant':59B 'higher':42B 'host':19B 'jetbrain':1A,16B,23B,62C 'let':6A,38B 'permiss':4A,29B,67C 'privileg':9A,43B,70C 'project':36B,73C 'right':60B 'self':18B 'self-host':17B 'tab':37B,74C 'use':53B 'user':7A,40B 'vendor':20B 'via':72C 'youtrack':2A,21B,24B,50B,63C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted YouTrack installations before 2026.2.19656 are affected, since the flaw is in the app permission handling of the project tab. The sources do not say whether JetBrains Cloud-hosted YouTrack instances are affected. Teams already on 2026.2.19656 or later can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jetbrains","medium","selfhosted","vendor","youtrack"],"campaign_type":null,"search_a":"'-123328':12A,15A '-2026':11A,14A 'app':3A 'bypass':5A 'cve':10A,13A 'escal':8A 'jetbrain':1A 'let':6A 'permiss':4A 'privileg':9A 'user':7A 'youtrack':2A","search_b":"'2026.2.19656':26B 'account':51B 'act':56B 'alreadi':47B 'app':28B 'attack':45B 'beyond':57B 'bypass':33B 'check':30B 'could':31B 'gain':41B 'grant':59B 'higher':42B 'host':19B 'jetbrain':16B,23B 'let':38B 'permiss':29B 'privileg':43B 'project':36B 'right':60B 'self':18B 'self-host':17B 'tab':37B 'use':53B 'user':40B 'vendor':20B 'youtrack':21B,24B,50B","search_c":"'2026.2.19656':65C 'allow':69C 'app':66C 'bypass':68C 'escal':71C 'jetbrain':62C 'permiss':67C 'privileg':70C 'project':73C 'tab':74C 'via':72C 'youtrack':63C","first_public_at":"2026-11-06T11:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123328","severity":null,"published_at":"2026-11-06T11:17:13+00:00","modified_at":"2026-11-06T11:17:13+00:00","first_seen_at":"2026-11-06T11:41:27+00:00","fetched_at":"2026-11-06T11:41:27+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}