CVE-2026-57925: JetBrains YouTrack Access Control Flaw – Query and Tag Disclosure

Technical summary

The vulnerability stems from improper access control (CWE-862) in YouTrack's query and tag retrieval mechanisms. The application fails to enforce adequate permission boundaries when returning saved queries and associated tags to authenticated users. This allows a logged-in user to enumerate and read saved queries and tags belonging to other users or organizational contexts beyond their assigned permissions. The issue affects all versions prior to 2026.2.16593, where access control enforcement was strengthened.

Business impact

Organizations using YouTrack for issue tracking and project management may face information disclosure through unauthorized access to saved queries and tags. If these queries contain or reference sensitive projects, restricted team assignments, or confidential search criteria, an internal attacker or compromised user account could gain visibility into workflows and metadata intended for restricted groups. This is particularly concerning in regulated environments where audit trails and segregation of duties matter. The impact is limited to confidentiality; data integrity and system availability are not affected.

Affected systems

JetBrains YouTrack installations running versions prior to 2026.2.16593 are vulnerable. This includes all on-premises and cloud-hosted deployments of YouTrack that have not been updated to the patched version. The vulnerability requires network access to the YouTrack instance and valid user credentials, making it primarily a risk to insider threat scenarios or compromised account scenarios.

Exploitability

Exploitation requires low privileges (a valid user account on the YouTrack instance) and no special user interaction or social engineering. An attacker with credentials can directly request saved queries and tags through normal application operations. The CVSS 3.1 score of 4.3 (MEDIUM severity) reflects the low attack complexity and the requirement for user authentication. Practical risk is elevated in environments with weak password policies, high user turnover, or shared accounts.

Remediation

Organizations must upgrade YouTrack to version 2026.2.16593 or later. Review your current deployment version in YouTrack settings under About and verify the build number. If you are on a managed cloud instance, check with JetBrains for automated update schedules. For on-premises installations, plan an upgrade during maintenance windows, as it may require service restart.

Patch guidance

Upgrade YouTrack to 2026.2.16593 or any subsequent release. Consult the JetBrains YouTrack release notes and upgrade guide to confirm compatibility with your environment and any custom plugins or integrations. Test the upgrade in a non-production environment if possible. After patching, access control enforcement will prevent unauthorized users from reading saved queries and tags belonging to others.

Detection guidance

Monitor YouTrack access logs for unusual query retrieval patterns, particularly users accessing queries they did not create or are not assigned to. Alert on rapid enumeration of saved queries across multiple projects or users. Review audit logs for access to tag metadata by users outside expected roles. Consider implementing network-level monitoring to baseline normal YouTrack API usage patterns, then flag deviations. No specific log signatures are available without vendor guidance, so focus on behavioral anomalies.

Why prioritize this

Although the CVSS score is MEDIUM (4.3) and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities list, it warrants timely patching because access control flaws in collaborative tools create persistent insider risk and compliance complications. The low barrier to exploitation (just needing valid credentials) means any compromised user account or insider threat actor can immediately leverage it. Organizations in regulated industries should prioritize this higher due to audit and data segregation requirements.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: (1) low attack complexity—no special conditions or tricks required; (2) low attack vector—network-accessible but requires authentication; (3) low privilege requirement—any user can trigger the flaw; (4) low scope impact—only confidentiality is breached, not integrity or availability. The score does not heavily penalize insider threat scenarios, which is why context matters. In environments with strict access controls and low user count, risk may be lower; in high-churn or high-privilege-density deployments, the practical risk is higher than the numerical score suggests.

Frequently asked questions