CVE-2026-57923: JetBrains YouTrack Auth Bypass Vulnerability

CVE-2026-57923 Overview

CVE-2026-57923 is an improper authorization vulnerability in JetBrains YouTrack versions before 2026.2.16593. The flaw exists in the app configurations endpoint, which fails to enforce access controls when processing project settings modifications. Attackers can send crafted network requests to alter project configurations without holding the required privileges. The weakness maps to CWE-862: Missing Authorization and affects the integrity of managed projects. JetBrains addressed the issue in a patched YouTrack release listed on its security advisory page.

Critical Impact
Unauthenticated network attackers can modify YouTrack project settings, corrupting configuration integrity across affected instances.

Affected Products

JetBrains YouTrack versions prior to 2026.2.16593
JetBrains YouTrack self-hosted deployments exposing the app configurations endpoint
JetBrains YouTrack instances reachable over the network without upgraded builds

Discovery Timeline

2026-06-26 - CVE-2026-57923 published to the National Vulnerability Database
2026-06-27 - Last updated in the NVD database

Technical Details for CVE-2026-57923

Vulnerability Analysis

JetBrains YouTrack exposes an app configurations endpoint used to manage integration and project-level settings. In vulnerable builds, the endpoint accepts modification requests without validating whether the caller holds project administration rights. The server processes the change and persists the new configuration state. This allows adversaries to alter project settings that should remain restricted to authorized administrators.

The vulnerability affects integrity but does not expose confidential data or interrupt service availability. Exploitation requires only network reachability to the YouTrack instance. No user interaction is needed to complete the attack chain. Successful modifications may influence workflow behavior, notification routing, integration credentials handling, and other project-scoped settings. The EPSS probability score is 0.159%, reflecting a low observed exploitation likelihood at publication.

Root Cause

The root cause is a missing authorization check on the app configurations endpoint. The handler processes state-changing requests without verifying whether the requester has permission to alter project settings. This corresponds to [CWE-862], where an application performs a sensitive action without confirming the actor's rights.

Attack Vector

Exploitation occurs over the network against the YouTrack HTTP interface. An attacker submits a crafted request to the app configurations endpoint targeting project settings modification. Because the authorization gate is absent, the server accepts and applies the change. No privileges or user interaction are required, and the attack complexity is low.

No public proof-of-concept exploit code is available for CVE-2026-57923. Refer to the JetBrains Security Fixes advisory for authoritative technical guidance.

Detection Methods for CVE-2026-57923

Indicators of Compromise

Unexpected changes to YouTrack project settings, workflows, or integrations that do not correlate with administrator activity
HTTP requests to the app configurations endpoint originating from accounts without project administration rights
Anomalous request patterns to the YouTrack API from unauthenticated or low-privilege sessions

Detection Strategies

Review YouTrack audit logs for project settings modifications and cross-reference the acting principal against expected administrators
Alert on HTTP POST, PUT, or PATCH requests to app configuration paths from unusual source addresses
Baseline legitimate configuration change frequency and flag deviations for investigation

Monitoring Recommendations

Forward YouTrack application and access logs to a centralized analytics platform for correlation
Enable alerting on privileged setting changes tied to service or integration accounts
Monitor JetBrains security advisories for updated indicators tied to this CVE

How to Mitigate CVE-2026-57923

Immediate Actions Required

Upgrade JetBrains YouTrack to version 2026.2.16593 or later without delay
Inventory all self-hosted YouTrack instances and confirm each is running a patched build
Restrict network exposure of the YouTrack interface to trusted management networks where feasible
Audit recent project setting changes to identify unauthorized modifications

Patch Information

JetBrains released a fixed build in YouTrack 2026.2.16593. Upgrade instructions and the full list of resolved security issues are documented on the JetBrains Security Fixes page. Cloud-hosted YouTrack tenants receive the fix from JetBrains directly.

Workarounds

Place YouTrack behind a reverse proxy or VPN to limit reachability of the app configurations endpoint
Enforce network-layer access control lists restricting who can reach YouTrack HTTP endpoints
Increase monitoring of project setting changes until the patched version is deployed

bash

# Verify the running YouTrack version and confirm it is at or above the fixed release
curl -s https://youtrack.example.com/api/config | jq '.version'
# Expected output: "2026.2.16593" or later