CVE-2026-57924: JetBrains YouTrack Default Role Information Disclosure

Technical summary

CVE-2026-57924 is rooted in improper access control (CWE-276) within YouTrack's default role configuration. The vulnerability allows authenticated users (PR:L) to retrieve excessive user profile details via network access without requiring user interaction. The attack vector is network-based, the attack complexity is low, and impact is confined to confidentiality—integrity and availability remain unaffected. CVSS 3.1 score of 4.3 (MEDIUM) reflects the requirement for prior authentication and the limited scope of exposure.

Business impact

This vulnerability poses a privacy and compliance risk. Exposure of user profile details to unauthorized internal viewers could violate data protection regulations (GDPR, CCPA, HIPAA depending on deployments) and erode user trust. For organizations using YouTrack for team collaboration, unintended exposure of employee contact information, real names, or organizational metadata could facilitate social engineering or internal harassment. The impact is primarily reputational and regulatory rather than operational.

Affected systems

JetBrains YouTrack releases prior to version 2026.2.16593 are affected. Organizations running YouTrack on-premises or via managed services with automatic updates disabled remain vulnerable until patched. The vulnerability requires authenticated access, so exposed instances are limited to those with active user accounts.

Exploitability

Exploitation requires valid YouTrack credentials, making opportunistic attacks unlikely. However, any authenticated user—including low-privilege team members or contractors—can trigger exposure with minimal effort and no special tooling. The low attack complexity means attackers need only craft standard API queries or browse the user interface. This is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no active wild exploitation at publication, though this does not guarantee future safety.

Remediation

Upgrade JetBrains YouTrack to version 2026.2.16593 or later. The patch corrects default role configuration to restrict user profile visibility according to principle of least privilege. Organizations unable to upgrade immediately should audit YouTrack role permissions and disable or restrict default roles that expose sensitive profile fields.

Patch guidance

Deploy the 2026.2.16593 release or any subsequent version. Verify compatibility with your deployment architecture and test in a staging environment before production rollout. No breaking changes are documented for this patch. After upgrade, review custom role configurations to ensure they align with your organization's principle of least privilege for user data visibility.

Detection guidance

Monitor YouTrack audit logs for bulk or repeated user profile queries by low-privilege accounts. Review role assignments to identify unexpected visibility grants on sensitive user attributes. Query the REST API with a low-privilege test account to confirm that profile fields (email, real name, organizational metadata) are not returned in user list or profile endpoints. SIEM rules can alert on anomalous user data access patterns within YouTrack.

Why prioritize this

Although CVSS 4.3 (MEDIUM) might suggest lower urgency, prioritize based on your data classification and regulatory context. Organizations subject to strict data protection requirements should treat this as higher priority, especially if YouTrack stores PII or if unauthorized internal data exposure poses compliance risk. The requirement for authentication limits blast radius and justifies lower urgency in air-gapped or single-team deployments.

Risk score, explained

CVSS 3.1 score of 4.3 reflects the combination of network accessibility, low attack complexity, and mandatory authentication (PR:L) balanced against limited confidentiality impact and no integrity or availability loss. The MEDIUM severity is appropriate for a privacy-focused issue that requires prior system access but poses no direct service disruption.

Frequently asked questions