{"id":"CVE-2026-123332","kind":"vulnerability","aliases":["CVE-2026-123332"],"related":[],"title":"JetBrains YouTrack: project admins can manage VCS hosting server configurations","description":"In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations","summary":"Before version 2026.2.19562, a missing authorization check in JetBrains YouTrack let a Project Admin change VCS hosting server configurations they should not control. The sources do not say what further access that gives an attacker.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jetbrains","other","self-hosted","youtrack"],"not_affected_if":["no-project-admins","version-2026.2.19562-or-later"],"how_to_check":"- Check the YouTrack version in the admin panel or on the server, and compare it with `2026.2.19562`\n- Review who holds the Project Admin role in YouTrack","fix":"- JetBrains YouTrack: upgrade to `2026.2.19562` or later","status":"open","published_at":"2026-11-06T11:17:13+00:00","first_seen_at":"2026-11-06T11:41:28+00:00","triaged_at":"2026-11-06T11:42:39+00:00","updated_at":"2026-11-06T11:42:39+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T11:42:39Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains YouTrack: upgrade to `2026.2.19562` or later","reach":"network","title":"JetBrains YouTrack: project admins can manage VCS hosting server configurations","impact":"medium","summary":"Before version 2026.2.19562, a missing authorization check in JetBrains YouTrack let a Project Admin change VCS hosting server configurations they should not control. The sources do not say what further access that gives an attacker.","audience":"businesses","category":"other","nicknames":[],"who_cares":["youtrack","self-hosted","jetbrains"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Project admin changes VCS hosting server configurations without authorization","analyst_note":"","how_to_check":"- Check the YouTrack version in the admin panel or on the server, and compare it with `2026.2.19562`\n- Review who holds the Project Admin role in YouTrack","plain_action":"","needs_analyst":false,"not_affected_if":["version-2026.2.19562-or-later","no-project-admins"],"who_is_affected":"Teams that self-host JetBrains YouTrack and give users the Project Admin role. Instances already on 2026.2.19562 or later are not affected. Hosted YouTrack is handled by the vendor, and the sources do not say whether it was patched there.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":4180,"output_tokens":502,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123332':13A,16A '-2026':12A,15A '2026.2.19562':25B,62C 'access':53B 'admin':4A,36B,67C 'allow':65C 'attack':57B 'author':28B,64C 'chang':37B 'check':29B 'configur':10A,41B,73C 'control':45B 'cve':11A,14A 'give':55B 'host':8A,21B,39B,71C 'jetbrain':1A,17B,31B,59C 'let':33B 'manag':6A,69C 'miss':27B,63C 'project':3A,35B,66C 'say':50B 'self':20B 'self-host':19B 'server':9A,40B,72C 'sourc':47B 'vcs':7A,38B,70C 'version':24B 'youtrack':2A,22B,32B,60C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host JetBrains YouTrack and give users the Project Admin role. Instances already on 2026.2.19562 or later are not affected. Hosted YouTrack is handled by the vendor, and the sources do not say whether it was patched there.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jetbrains","medium","other","selfhosted","youtrack"],"campaign_type":null,"search_a":"'-123332':13A,16A '-2026':12A,15A 'admin':4A 'configur':10A 'cve':11A,14A 'host':8A 'jetbrain':1A 'manag':6A 'project':3A 'server':9A 'vcs':7A 'youtrack':2A","search_b":"'2026.2.19562':25B 'access':53B 'admin':36B 'attack':57B 'author':28B 'chang':37B 'check':29B 'configur':41B 'control':45B 'give':55B 'host':21B,39B 'jetbrain':17B,31B 'let':33B 'miss':27B 'project':35B 'say':50B 'self':20B 'self-host':19B 'server':40B 'sourc':47B 'vcs':38B 'version':24B 'youtrack':22B,32B","search_c":"'2026.2.19562':62C 'admin':67C 'allow':65C 'author':64C 'configur':73C 'host':71C 'jetbrain':59C 'manag':69C 'miss':63C 'project':66C 'server':72C 'vcs':70C 'youtrack':60C","first_public_at":"2026-11-06T11:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123332","severity":null,"published_at":"2026-11-06T11:17:13+00:00","modified_at":"2026-11-06T11:17:13+00:00","first_seen_at":"2026-11-06T11:41:28+00:00","fetched_at":"2026-11-06T11:41:28+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}