CVE-2026-49367: JetBrains IntelliJ IDEA Auth Bypass Flaw

CVE-2026-49367 Overview

CVE-2026-49367 affects JetBrains IntelliJ IDEA versions prior to 2026.1.1. The flaw allows command execution through the guest user account, bypassing intended authorization boundaries on the integrated development environment. The issue is classified under CWE-862 (Missing Authorization), indicating that privileged operations were exposed to accounts that should have only limited interactive access.

An authenticated guest user can leverage the weakness to execute commands within the IDE host context. The result is unauthorized code execution and potential compromise of the developer workstation or shared collaboration session.

Critical Impact

A low-privileged guest account can execute arbitrary commands on systems running vulnerable IntelliJ IDEA builds, leading to confidentiality, integrity, and availability impact on the host.

Affected Products

• JetBrains IntelliJ IDEA versions before 2026.1.1
• All editions distributed under cpe:2.3:a:jetbrains:intellij_idea
• Collaboration sessions configured with guest user access

Discovery Timeline

• 2026-05-29 - CVE-2026-49367 published to NVD
• 2026-06-01 - Last updated in NVD database
• 2026-06-04 - EPSS scoring updated for CVE-2026-49367

Technical Details for CVE-2026-49367

Vulnerability Analysis

The vulnerability resides in the authorization logic governing the IntelliJ IDEA guest user account. JetBrains supports collaborative coding sessions where remote participants connect as guests with intentionally restricted privileges. In affected builds, command execution actions reachable from the guest interface fail to enforce a required authorization check.

As a result, a participant joining a Code With Me or similar collaborative session as a guest can invoke command execution paths that should be reserved for the host. The vulnerability does not require user interaction beyond establishing the guest session and operates over the network attack surface exposed by the IDE.

Successful exploitation runs commands in the security context of the IDE process on the host machine. This exposes source code repositories, build pipelines, signing keys, and any credentials cached by plugins or version control integrations.

Root Cause

The root cause is a missing authorization control [CWE-862] on action handlers reachable by guest users. Privilege checks that should gate execution flows were either absent or incorrectly evaluated, treating guest sessions as equivalent to host sessions for the affected operations.

Attack Vector

Exploitation requires network reachability to a collaborative session and valid guest credentials, which are commonly distributed as session invitation links. Once joined, an attacker triggers the unauthorized command path from the guest client. No social engineering or additional user interaction on the host side is required.

No public proof-of-concept is currently listed in CISA KEV or Exploit-DB for CVE-2026-49367. Refer to the JetBrains Fixed Security Issues page for vendor technical detail.

Detection Methods for CVE-2026-49367

Indicators of Compromise

• Unexpected child processes spawned by idea64.exe, idea, or idea.sh on developer workstations
• Outbound network connections from the IDE process to non-corporate destinations following a guest collaboration session
• New or modified files in project directories that do not correlate with committed source control activity
• Guest session logs in IntelliJ IDEA showing command execution actions invoked by non-host participants

Detection Strategies

• Inventory IntelliJ IDEA installations and flag any version earlier than 2026.1.1 as exposed
• Correlate process creation telemetry where the parent process is IntelliJ IDEA with command shells such as cmd.exe, powershell.exe, bash, or sh
• Alert on IntelliJ IDEA processes invoking scripting engines or network utilities during active collaborative sessions

Monitoring Recommendations

• Enable verbose logging for Code With Me or equivalent collaboration features and forward logs to a centralized SIEM
• Monitor egress traffic from developer endpoints for connections initiated by the IDE process to unknown infrastructure
• Review guest session invitations for distribution outside trusted developer groups

How to Mitigate CVE-2026-49367

Immediate Actions Required

• Upgrade all JetBrains IntelliJ IDEA installations to version 2026.1.1 or later
• Disable Code With Me and other collaborative session features on hosts that cannot be patched immediately
• Revoke any active guest session links issued before the upgrade and rotate any credentials handled by the IDE

Patch Information

JetBrains addressed CVE-2026-49367 in IntelliJ IDEA 2026.1.1. The fix enforces the missing authorization check so that guest accounts can no longer reach command execution actions. Patch details and the complete list of fixed issues are published on the JetBrains Fixed Security Issues page.

Workarounds

• Restrict guest participation to read-only roles where the host configuration permits
• Limit collaborative sessions to trusted internal networks until patching is complete
• Run IntelliJ IDEA under a least-privileged user account to constrain the impact of any successful command execution

# Verify installed IntelliJ IDEA build on Linux/macOS
cat "$(dirname "$(readlink -f "$(command -v idea)")")/../build.txt"

# Windows: check the build number from PowerShell
Get-Content "$Env:LOCALAPPDATA\JetBrains\Toolbox\apps\IDEA-U\*\build.txt"