CVE-2026-103496: JetBrains YouTrack Information Disclosure

CVE-2026-103496 Overview

CVE-2026-103496 is an Insecure Direct Object Reference (IDOR) vulnerability in JetBrains YouTrack versions prior to 2026.2.19422. The flaw resides in the inbox threads functionality and allows an authenticated user to read notifications belonging to other users. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated attackers can access other users' inbox notification contents, exposing confidential project discussions, issue updates, and internal communications shared via YouTrack.

Affected Products

JetBrains YouTrack versions before 2026.2.19422
Self-hosted YouTrack Server deployments
YouTrack InCloud instances prior to the patched release

Discovery Timeline

2026-10-01 - CVE-2026-103496 published to the National Vulnerability Database
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-103496

Vulnerability Analysis

The vulnerability affects the inbox threads feature of JetBrains YouTrack, which displays notifications associated with issues, comments, and mentions. YouTrack failed to verify that the authenticated user requesting a thread was the legitimate owner of the referenced notification.

An attacker with a valid low-privilege YouTrack account can manipulate the identifier used to fetch notification threads. By substituting another user's notification identifier, the attacker retrieves notifications that the targeted account would normally see privately in their inbox.

Exposed content can include issue comments, state changes, mentions, and attachments referenced by notifications. In organizations that use YouTrack for internal project tracking, this exposes confidential planning data, security discussions, and customer information shared through issues.

Root Cause

The root cause is a missing authorization check on the inbox thread endpoint. The backend trusted a user-supplied notification or thread identifier without validating that the requesting principal matched the notification recipient. This maps directly to [CWE-639], where access control is enforced through an identifier assumption rather than a server-side ownership check.

Attack Vector

Exploitation requires network access to a YouTrack instance and a valid authenticated session with low privileges. No user interaction is required. An attacker enumerates or guesses notification identifiers and issues direct API requests to the inbox thread endpoint. Successful requests return notification data belonging to other users without triggering access-denied responses.

The vulnerability does not permit modification of data or impact service availability. Confidentiality and limited integrity impact to notification metadata are the primary risks.

Detection Methods for CVE-2026-103496

Indicators of Compromise

Unusual volumes of requests to YouTrack inbox or notification thread API endpoints from a single authenticated user
Sequential or enumerated notification identifier values appearing in access logs for a single session
API responses containing notification payloads for recipients other than the authenticated requester
Authenticated accounts accessing inbox resources outside of normal UI navigation patterns

Detection Strategies

Review YouTrack application logs for repeated GET requests to inbox thread endpoints that return successful responses across many distinct identifiers
Correlate authenticated session identifiers against the notification recipient fields returned in responses to detect mismatches
Baseline typical inbox API request rates per user and alert when a user exceeds normal thresholds

Monitoring Recommendations

Forward YouTrack access and audit logs to a centralized log analytics platform for retention and correlation
Enable account-level anomaly detection on authenticated API consumption rates
Monitor administrative and service accounts for inbox endpoint access, which is uncommon in normal operation

How to Mitigate CVE-2026-103496

Immediate Actions Required

Upgrade JetBrains YouTrack to version 2026.2.19422 or later as published in the JetBrains Security Issue Fixes advisory
Inventory all self-hosted YouTrack instances and confirm patch status across production and staging environments
Review recent access logs for signs of inbox enumeration prior to patching
Rotate credentials and session tokens for any accounts suspected of unauthorized inbox access

Patch Information

JetBrains addressed the issue in YouTrack 2026.2.19422. Administrators should consult the JetBrains Security Issue Fixes page for release details and apply the update through the standard YouTrack upgrade workflow. YouTrack InCloud tenants receive the fix automatically from JetBrains.

Workarounds

No vendor-supplied workaround is published; upgrading to the fixed version is the required remediation
Restrict YouTrack access to trusted networks or VPN-only reachability to reduce the authenticated attacker population until patching completes
Enforce strong authentication, including single sign-on and multi-factor authentication, to limit the pool of accounts an attacker can use for exploitation

bash

# Verify installed YouTrack version on a self-hosted instance
curl -s https://youtrack.example.com/api/config | jq '.version'

# Expected post-patch value: 2026.2.19422 or later