CVE-2026-86489: JetBrains YouTrack IDOR Vulnerability

CVE-2026-86489 Overview

CVE-2026-86489 is an Insecure Direct Object Reference (IDOR) vulnerability in JetBrains YouTrack versions prior to 2026.2.18634. The flaw resides in the user profile API and allows an authenticated user to enumerate private issues and starred folders belonging to users in other organizations. The weakness is classified as [CWE-639: Authorization Bypass Through User-Controlled Key]. Exploitation requires only low-privileged authenticated access over the network and results in confidentiality loss without impacting integrity or availability.

Critical Impact
Authenticated attackers can retrieve private issues and starred folders across organizational boundaries through the user profile API, leading to cross-tenant information disclosure.

Affected Products

JetBrains YouTrack versions before 2026.2.18634

Discovery Timeline

2026-09-07 - CVE-2026-86489 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86489

Vulnerability Analysis

JetBrains YouTrack exposes user profile endpoints that return metadata about a user's issues and starred folders. The affected endpoints accept a user-controlled identifier and return referenced objects without verifying that the requesting principal has authorization to view them. As a result, a low-privileged authenticated user in one organization can request the profile-linked resources of a user in a different organization and receive private issue data and starred folder contents.

The issue is classified under [CWE-639] because access decisions rely on the identifier supplied in the request rather than on a server-side authorization check bound to the caller's session and tenancy. Cross-tenant isolation, which is a foundational assumption in multi-organization SaaS deployments of YouTrack, is not enforced at the API layer.

Root Cause

The root cause is missing authorization enforcement on the user profile API. The endpoint dereferences the supplied user or resource identifier and returns the associated private issues and starred folders without validating that the current session is entitled to those objects. Organization scoping is not applied to the query path.

Attack Vector

Exploitation is performed over the network by an authenticated user holding a low-privileged account. The attacker issues a crafted request to the vulnerable user profile API endpoint, substituting the target user's identifier. The server returns private issues and starred folder data that should be restricted to that user's organization. No user interaction is required and attack complexity is low.

See the JetBrains Security Issues Fixed advisory for vendor-published technical detail.

Detection Methods for CVE-2026-86489

Indicators of Compromise

Authenticated requests to YouTrack user profile API endpoints referencing user identifiers that do not belong to the caller's organization.
Sequential or enumerated user identifier patterns in API access logs originating from a single session or IP.
Unusual volume of successful HTTP 200 responses from the user profile API relative to baseline for a given account.

Detection Strategies

Correlate API access logs against user-to-organization mappings and alert when a session retrieves profile data outside its tenant scope.
Deploy rate-based rules on the user profile API to identify enumeration patterns against user identifiers.
Review historical access logs from before patch deployment for cross-organization profile queries.

Monitoring Recommendations

Forward YouTrack application and API access logs to a centralized analytics platform with retention sufficient to support retrospective hunting.
Baseline normal per-user API request volumes to the user profile endpoint and alert on deviations.
Monitor authentication events for accounts exhibiting reconnaissance behavior such as bulk profile queries.

How to Mitigate CVE-2026-86489

Immediate Actions Required

Upgrade JetBrains YouTrack to version 2026.2.18634 or later.
Audit user profile API access logs for cross-organization requests since the last known-good baseline.
Rotate any credentials, tokens, or issue-linked secrets that may have been exposed in disclosed private issues.

Patch Information

JetBrains resolved the vulnerability in YouTrack 2026.2.18634. Administrators should apply the update through the standard YouTrack upgrade process. Refer to the JetBrains Security Issues Fixed page for release detail and additional advisories.

Workarounds

No vendor-supplied workaround is documented. Upgrading to 2026.2.18634 is the recommended remediation.
Where immediate patching is not feasible, restrict network access to the YouTrack instance to trusted networks and reduce the number of accounts able to authenticate.
Review and minimize the granted role of low-privileged accounts pending the upgrade.

bash

# Verify the running YouTrack version after upgrade
curl -s -H "Authorization: Bearer $YT_TOKEN" \
  https://youtrack.example.com/api/config | jq '.version'