CVE-2026-49370: JetBrains YouTrack Information Disclosure – fetchApp Request Vulnerability

Technical summary

CVE-2026-49370 is classified as an information disclosure vulnerability (CWE-201) in the fetchApp request processing logic of JetBrains YouTrack. The vulnerability has a CVSS v3.1 score of 3.4 (Low severity) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N. Exploitation requires network access, high privilege level (PR:H), and user interaction (UI:R), while the confidentiality impact is limited (C:L) with no integrity or availability compromise. The vulnerability was identified and patched in version 2026.1.13162.

Business impact

The limited scope of this vulnerability—requiring high-privilege authentication, user interaction, and producing only partial information disclosure—minimizes immediate business risk for most YouTrack deployments. Organizations should prioritize patching instances where trusted administrators or power users have been compromised or where internal threat actors may be present. The lack of CISA KEV status and low CVSS score indicate this is not an active exploitation vector in the wild, though it remains a valid privilege-escalation concern in zero-trust or multi-tenant environments.

Affected systems

JetBrains YouTrack installations running versions prior to 2026.1.13162 are affected. The vulnerability is limited to the fetchApp request handler and requires an authenticated, high-privilege user to trigger. Cloud-hosted and self-hosted deployments are equally affected. Verify your current YouTrack version and cross-reference against your deployment model to assess scope.

Exploitability

Exploitability is low due to authentication and privilege requirements. An attacker must already possess high-privilege credentials (such as administrator or power-user roles) and interact directly with the application—it cannot be triggered through passive attack vectors or by unauthorized users. The network vector is unauthenticated-accessible, but the authentication gate and required user interaction substantially reduce practical risk. No active exploits are documented in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Upgrade JetBrains YouTrack to version 2026.1.13162 or later. This is a straightforward patching exercise with low business disruption expected given the low severity classification. Test the patch in a non-production environment first to validate compatibility with custom configurations, plugins, or integrations before rolling out to production.

Patch guidance

Obtain the patched version (2026.1.13162 or newer) from JetBrains' official distribution channels. Review the release notes for any breaking changes or deprecations. For self-hosted deployments, follow JetBrains' documented upgrade procedure, including backup and rollback planning. For cloud-hosted instances, verify that your hosting provider has applied the patch. Most organizations should prioritize this update for future maintenance windows rather than treating it as an emergency change.

Detection guidance

Monitor fetchApp request logs for unusual patterns, particularly requests from high-privilege accounts that result in HTTP 200 responses with unexpectedly large payloads or sensitive data fields. Use your YouTrack audit logs to identify which high-privilege users have executed fetchApp requests recently. Correlation with user activity logs can help surface suspicious timing or frequency. Consider implementing network-level inspection of YouTrack traffic to high-privilege API endpoints if risk posture demands it.

Why prioritize this

This vulnerability scores low on the CVSS scale (3.4) and carries no ransomware or active exploitation signals. Prioritize it below critical/high-severity items, but include it in standard patch cycles. Organizations with strict zero-trust postures, multi-tenant deployments, or recent incidents involving compromised admin accounts should bump it up in queue. The combination of required privilege level and user interaction makes it a secondary concern compared to unauthenticated or low-privilege flaws.

Risk score, explained

The CVSS score of 3.4 reflects the several barriers to exploitation: high privilege requirement (PR:H), mandatory user interaction (UI:R), and limited confidentiality impact (C:L). Network accessibility (AV:N) and low attack complexity (AC:L) prevent an even lower score, but the privilege gate is the dominant mitigating factor. In environments with strict access controls, the effective risk is further reduced.

Frequently asked questions