CVE-2025-64684: JetBrains YouTrack Information Disclosure

CVE-2025-64684 Overview

CVE-2025-64684 is an information disclosure vulnerability affecting JetBrains YouTrack, a popular project management and issue tracking platform. The vulnerability exists in versions prior to 2025.3.104432 and allows attackers to extract sensitive information through the application's feedback form functionality. This Missing Authorization (CWE-862) vulnerability can be exploited remotely without authentication, potentially exposing confidential data to unauthorized parties.

Critical Impact

Unauthenticated attackers can exploit the feedback form to disclose sensitive information, potentially compromising confidential project data, user details, or internal system information.

Affected Products

• JetBrains YouTrack versions prior to 2025.3.104432

Discovery Timeline

• 2025-11-10 - CVE CVE-2025-64684 published to NVD
• 2025-11-21 - Last updated in NVD database

Technical Details for CVE-2025-64684

Vulnerability Analysis

This vulnerability stems from a Missing Authorization flaw (CWE-862) in JetBrains YouTrack's feedback form functionality. The application fails to properly enforce authorization checks when processing feedback form requests, allowing unauthenticated users to access information that should be restricted. The network-accessible nature of this vulnerability means attackers can exploit it remotely without requiring any user interaction or prior authentication to the system.

The information disclosure occurs because the feedback form endpoint does not adequately validate whether the requesting user has appropriate permissions to access the underlying data. This oversight enables attackers to craft requests that bypass intended access controls and retrieve sensitive information directly through the feedback mechanism.

Root Cause

The root cause is improper implementation of authorization controls (CWE-862) within the feedback form component. The application neglects to verify that users submitting or interacting with feedback forms have the necessary permissions to access associated data. This missing authorization check creates a direct pathway for information leakage through what should be a routine user interaction feature.

Attack Vector

Attackers can exploit this vulnerability remotely over the network by sending crafted requests to the feedback form endpoint. The attack requires no authentication and no user interaction, making it relatively straightforward to execute. An attacker would target the feedback form functionality and manipulate requests to extract information that the endpoint inadvertently exposes due to the missing authorization checks.

The vulnerability specifically impacts confidentiality, as the exposed data could include sensitive project information, user details, or internal configuration data depending on what information is processed by the feedback form system.

Detection Methods for CVE-2025-64684

Indicators of Compromise

• Unusual patterns of requests to feedback form endpoints, particularly from external or unknown IP addresses
• Anomalous response sizes from the feedback form API that may indicate data extraction
• Multiple sequential requests to feedback-related endpoints from the same source in a short time period
• Access log entries showing feedback form interactions without corresponding authenticated sessions

Detection Strategies

• Implement web application firewall (WAF) rules to monitor and alert on suspicious feedback form request patterns
• Review access logs for the YouTrack feedback form endpoints for unauthorized access attempts
• Deploy intrusion detection signatures to identify exploitation attempts targeting this specific functionality
• Monitor for bulk data extraction patterns that may indicate active exploitation

Monitoring Recommendations

• Enable detailed logging for all feedback form interactions and API calls
• Configure alerts for requests to feedback endpoints from unauthenticated sessions
• Establish baseline metrics for normal feedback form usage to identify anomalous activity
• Implement real-time monitoring of YouTrack application logs for potential exploitation indicators

How to Mitigate CVE-2025-64684

Immediate Actions Required

• Upgrade JetBrains YouTrack to version 2025.3.104432 or later immediately
• Review access logs to determine if exploitation has occurred prior to patching
• Restrict network access to YouTrack instances to trusted networks where possible until patching is complete
• Consider temporarily disabling or restricting access to the feedback form functionality if immediate patching is not feasible

Patch Information

JetBrains has addressed this vulnerability in YouTrack version 2025.3.104432. Organizations running affected versions should upgrade to this release or later as soon as possible. For detailed patch information and additional security fixes, refer to the JetBrains Security Issues Fixed advisory page.

Workarounds

• Implement network-level access controls to restrict access to YouTrack from untrusted networks
• Use a reverse proxy or WAF to add additional authentication layers in front of the feedback form endpoints
• Monitor and rate-limit requests to feedback form functionality to reduce the potential impact of exploitation attempts
• If patching is delayed, consider disabling the feedback form feature through application configuration until the update can be applied