CVE-2026-103491 Overview
CVE-2026-103491 is an Insecure Direct Object Reference (IDOR) vulnerability in JetBrains YouTrack versions before 2026.2.19422. The flaw resides in the issue activities API, where improper authorization checks allow authenticated users to read restricted issues they should not have access to. The weakness is categorized as CWE-639: Authorization Bypass Through User-Controlled Key. Exploitation requires network access and low-privilege authenticated credentials, but no user interaction. Successful exploitation discloses confidential issue data, which may include sensitive project information, credentials shared in comments, or internal planning details.
Critical Impact
Authenticated attackers can retrieve restricted YouTrack issue data through the activities API, breaking project-level access boundaries and exposing confidential information.
Affected Products
- JetBrains YouTrack versions prior to 2026.2.19422
- Self-hosted YouTrack Server deployments
- YouTrack InCloud instances prior to the patched build
Discovery Timeline
- 2026-10-01 - CVE-2026-103491 published to NVD
- 2026-10-01 - Last updated in NVD database
Technical Details for CVE-2026-103491
Vulnerability Analysis
The vulnerability stems from missing or incorrect authorization checks in the YouTrack issue activities API endpoint. YouTrack enforces per-issue permissions based on project membership and visibility settings. The activities API, which returns the history of events for an issue, failed to re-validate the requesting user's permission against the target issue identifier.
An authenticated attacker can supply the identifier of a restricted issue in an API request. The server returns activity data without confirming the caller has read access to that issue. This exposes change history, field updates, comments, and other metadata tied to restricted work items.
The issue is classified as an Insecure Direct Object Reference because the issue ID is a user-controlled key that directly references a backend resource without an accompanying access-control check.
Root Cause
The root cause is a broken access control implementation in the issue activities endpoint. Permission validation was applied at the top-level issue retrieval path but not consistently applied to the activities sub-resource. The authorization decision relied on the request being authenticated rather than the authenticated principal being authorized for the referenced issue.
Attack Vector
Exploitation requires valid YouTrack credentials with any standard user role. The attacker enumerates or guesses issue identifiers, which follow a predictable PROJECT-NUMBER scheme. The attacker then issues HTTP requests to the activities API endpoint for each identifier. Restricted issues return activity data instead of an authorization error, confirming the IDOR and leaking content.
See the JetBrains security advisory for vendor technical details.
Detection Methods for CVE-2026-103491
Indicators of Compromise
- Unusual volume of requests to the YouTrack issue activities API from a single authenticated session.
- Sequential enumeration of issue identifiers (PROJECT-1, PROJECT-2, PROJECT-3) in access logs.
- Successful API responses for issues the account does not have UI-level access to.
- Access patterns from service accounts or low-privilege users targeting restricted projects.
Detection Strategies
- Audit YouTrack HTTP access logs for high-rate GET requests to activities API paths.
- Correlate API access events against each user's documented project membership.
- Alert on authenticated sessions that request issue IDs across projects the user does not belong to.
Monitoring Recommendations
- Forward YouTrack application and reverse-proxy logs to a centralized logging platform for retention and query.
- Baseline normal API call volumes per user and alert on statistical deviations.
- Review YouTrack audit trails for bulk read activity after upgrading, to identify prior abuse.
How to Mitigate CVE-2026-103491
Immediate Actions Required
- Upgrade all YouTrack Server instances to version 2026.2.19422 or later without delay.
- For YouTrack InCloud customers, confirm the hosted instance has been updated by JetBrains.
- Rotate any API tokens or shared credentials that may have been exposed through restricted issue content.
- Review access logs for suspicious enumeration of issue identifiers before the patch date.
Patch Information
JetBrains has resolved CVE-2026-103491 in YouTrack 2026.2.19422. Administrators should refer to the JetBrains Security Issues Fixed page for the official release notes and upgrade instructions.
Workarounds
- Restrict network access to the YouTrack instance to trusted corporate networks or VPN until patching is complete.
- Reduce the number of accounts with authenticated access to limit the exploitation surface.
- Disable or revoke unused API tokens and guest-level accounts.
- Enforce short session lifetimes and multi-factor authentication to raise the cost of credential-based access.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
