CVE-2026-49369: JetBrains YouTrack Information Disclosure in Users and Groups Pages

Technical summary

CVE-2026-49369 is an information disclosure vulnerability stemming from improper access control (CWE-863) in JetBrains YouTrack's administrative interface. The flaw permits authenticated users with lower privilege levels to retrieve unauthorized information from the Users and Groups management pages. The vulnerability does not require user interaction and operates over the network. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a network-accessible, low-complexity attack requiring only standard login credentials, with limited confidentiality impact and no integrity or availability compromise.

Business impact

The exposure of user and group information can facilitate social engineering, privilege escalation planning, and compliance violations. Organizations using YouTrack for internal project management risk leaking organizational structure details, email addresses, and group membership information to lower-privileged insiders. In regulated environments, unauthorized information access may trigger audit findings and require breach notification analysis depending on data sensitivity and regulatory scope.

Affected systems

JetBrains YouTrack installations prior to version 2026.1.13162 are affected. The vulnerability is specific to YouTrack and does not affect other JetBrains products. All deployment types (cloud, self-hosted) running the vulnerable version are at risk. Verify your installed version against the vendor's official release notes to confirm impact.

Exploitability

Exploitation requires valid YouTrack credentials and network access to the instance. The attack is straightforward and does not require sophisticated techniques or user interaction. Any authenticated user can navigate to the Users and Groups pages to retrieve restricted information. The barrier to exploitation is minimal once credentials are obtained, making this a concern for organizations with many YouTrack users or federated authentication systems.

Remediation

Upgrade JetBrains YouTrack to version 2026.1.13162 or later. Organizations should verify the specific patch version against JetBrains' official security advisory and release notes. If immediate patching is not feasible, restrict administrative page access through network-level controls (IP whitelisting, VPN requirements) and monitor access logs for suspicious queries to the Users and Groups pages.

Patch guidance

Deploy YouTrack version 2026.1.13162 or later through JetBrains' standard update mechanisms. Review release notes to identify any configuration changes or compatibility considerations. Test the update in a non-production environment first to ensure compatibility with customizations and integrations. After patching, verify that access controls to sensitive administrative pages are functioning as intended.

Detection guidance

Monitor YouTrack access logs for authenticated users accessing the Users and Groups administrative pages who do not have legitimate administrative responsibilities. Check for repeated or bulk queries to these endpoints from non-admin accounts. Review audit trails for changes to user visibility or access permission settings. In SIEM systems, create alerts for failed or suspicious access attempts to administrative interfaces by low-privilege users.

Why prioritize this

Although rated MEDIUM severity with limited exploitability, this vulnerability should be prioritized based on your environment's sensitivity. Organizations with high-value user data, strict compliance requirements, or significant numbers of non-administrative users should patch within 30 days. Environments where YouTrack user lists correlate with sensitive operational information warrant faster remediation. If you use federated authentication or shared access models, prioritize accordingly.

Risk score, explained

The CVSS 4.3 MEDIUM score reflects the requirement for prior authentication, network accessibility, low attack complexity, and limited scope of impact (confidentiality only). The score would be lower if the flaw required special privileges or user interaction. It is not higher because there is no integrity or availability impact and the confidentiality breach is confined to user and group metadata rather than core application data or customer information.

Frequently asked questions