CVE-2026-111092: JetBrains YouTrack Auth Bypass Vulnerability

CVE-2026-111092 Overview

CVE-2026-111092 is a missing authorization vulnerability [CWE-862] in JetBrains YouTrack. Mail rules allowed a project administrator to execute issue commands across projects outside their authorization scope. The flaw affects YouTrack versions prior to 2026.2.19575, 2026.3.16075, 2026.3.16397, and 2026.3.16402.

The vulnerability requires authenticated access with project administrator privileges. Successful exploitation lets an attacker modify issues in projects they should not be able to access, breaking tenant isolation inside shared YouTrack instances.

Critical Impact
A project administrator can issue commands against issues in projects outside their assigned scope through mail rules, enabling unauthorized issue modification and cross-project tampering.

Affected Products

JetBrains YouTrack versions prior to 2026.2.19575
JetBrains YouTrack versions prior to 2026.3.16075, 2026.3.16397, and 2026.3.16402
Deployments where multiple projects share a single YouTrack instance

Discovery Timeline

2026-10-15 - CVE-2026-111092 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-111092

Vulnerability Analysis

JetBrains YouTrack mail rules let administrators automate issue handling based on incoming email. The rules can trigger issue commands such as state transitions, assignments, tag changes, and comments. The authorization layer failed to validate that the issuing administrator had rights over the target project before executing commands dispatched through a mail rule.

As a result, a project administrator could craft mail rules whose commands affected issues in other projects. The scope of the compromise depends on the YouTrack tenant layout. In multi-team instances, this allows one project owner to manipulate work items belonging to unrelated teams.

The EPSS score is 0.274% at the 18.777 percentile, reflecting a low near-term exploitation probability. The attack still has operational significance for organizations that rely on YouTrack project boundaries for data segregation.

Root Cause

The root cause is a missing authorization check [CWE-862] in the mail rule command execution path. YouTrack trusted the rule context without re-validating per-command target project permissions. Authentication and project-level role assignment were enforced, but cross-project command dispatch was not gated behind an additional authorization decision.

Attack Vector

An authenticated user with the project administrator role defines a mail rule that references issues or commands targeting a project outside their authorization. Incoming mail processed by that rule triggers command execution against the foreign project. The attack requires no user interaction from victims and operates over the network through the normal YouTrack mail integration workflow.

No verified public proof-of-concept code is available. Refer to the JetBrains Security Issues Fixed advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-111092

Indicators of Compromise

Issue history entries showing state transitions, assignments, or comments triggered by a mail rule owned by an administrator of a different project.
Mail rule definitions that reference projects outside the owning administrator's assigned scope.
Unexpected bulk command executions correlated with inbound email processing timestamps.

Detection Strategies

Audit all mail rule configurations and compare target projects against each creator's role assignments.
Review YouTrack audit logs for cross-project command executions originating from mail rule triggers.
Correlate issue modification events with the identity and project scope of the mail rule owner.

Monitoring Recommendations

Alert when a mail rule is created or modified by a non-system administrator and references multiple projects.
Forward YouTrack audit logs to a centralized SIEM for retention and correlation with identity events.
Monitor for sudden spikes in issue command volume attributable to a single administrator account.

How to Mitigate CVE-2026-111092

Immediate Actions Required

Upgrade JetBrains YouTrack to version 2026.2.19575, 2026.3.16075, 2026.3.16397, 2026.3.16402, or later.
Inventory current mail rules and remove any that reference projects outside the owning administrator's scope.
Review the project administrator role assignments and remove unnecessary grants.

Patch Information

JetBrains fixed the issue in YouTrack 2026.2.19575, 2026.3.16075, 2026.3.16397, and 2026.3.16402. The fix enforces per-command target project authorization inside the mail rule execution path. Patch details are listed in the JetBrains Security Issues Fixed bulletin.

Workarounds

Restrict the project administrator role to trusted users until the upgrade is applied.
Disable mail rule processing on affected YouTrack instances where immediate patching is not feasible.
Segregate sensitive projects onto a separate YouTrack instance to prevent cross-project command dispatch.

bash

# Verify running YouTrack version against fixed releases
curl -s -H "Authorization: Bearer <token>" \
  https://<youtrack-host>/api/config | jq '.version'

# Expected: 2026.2.19575, 2026.3.16075, 2026.3.16397, 2026.3.16402, or later