CVE-2026-86490: JetBrains YouTrack Privilege Escalation

CVE-2026-86490 Overview

CVE-2026-86490 is an improper authorization vulnerability in JetBrains YouTrack versions before 2026.2.18634. The flaw resides in the app import endpoint, which fails to enforce sufficient permission checks. An authenticated attacker with low privileges can overwrite bundled apps shipped with the YouTrack instance. Successful exploitation compromises the integrity of trusted application components without requiring user interaction. The weakness is classified under [CWE-863] Incorrect Authorization. JetBrains addressed the issue in the 2026.2.18634 release, listed on the JetBrains Security Fixes List.

Critical Impact
Authenticated attackers can overwrite bundled YouTrack apps through the import endpoint, undermining application integrity and enabling downstream tampering of trusted functionality.

Affected Products

JetBrains YouTrack versions prior to 2026.2.18634
YouTrack app import endpoint component
Bundled apps distributed with JetBrains YouTrack

Discovery Timeline

2026-09-07 - CVE CVE-2026-86490 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86490

Vulnerability Analysis

The vulnerability affects the JetBrains YouTrack app import functionality. YouTrack ships with bundled apps that extend core capabilities. The app import endpoint should restrict which principals may modify these bundled components. Instead, the endpoint accepts import requests from users without validating that they hold the required administrative permissions. An attacker with a low-privileged authenticated session can submit a crafted import request that replaces bundled apps with attacker-controlled versions. This breaks the integrity boundary between platform-provided code and user-supplied extensions.

Root Cause

The root cause is an incorrect authorization check [CWE-863] in the app import handler. The endpoint verifies that the caller is authenticated but does not confirm that the caller holds the administrative role required to modify bundled apps. This authorization gap allows write operations against protected app resources from any authenticated context.

Attack Vector

Exploitation requires network access to the YouTrack web interface and a valid low-privilege account. No user interaction is required. The attacker issues an app import request targeting a bundled app identifier. Because the endpoint does not enforce role-based restrictions, the request succeeds and overwrites the bundled app package. Overwritten bundled apps can be leveraged to persist attacker code in trusted execution contexts, tamper with issue-tracking workflows, or stage further attacks against project data.

No verified public proof-of-concept code is available. Refer to the JetBrains Security Fixes List for vendor-supplied technical details.

Detection Methods for CVE-2026-86490

Indicators of Compromise

Unexpected modifications to bundled app files or package hashes on the YouTrack server file system.
App import API requests originating from non-administrative user accounts in YouTrack audit logs.
Changes to bundled app version metadata that do not correspond to a JetBrains release.

Detection Strategies

Review YouTrack audit logs for calls to the app import endpoint and correlate the calling account against the administrator role list.
Compare on-disk bundled app bundles against the vendor-shipped hashes for the installed YouTrack version.
Alert on any successful app import event executed by a user without the global administrator permission.

Monitoring Recommendations

Forward YouTrack application and access logs to a centralized SIEM for continuous review of app management activity.
Track authentication events and privilege usage for accounts that interact with /api/apps or equivalent management routes.
Establish a baseline of legitimate app management activity and alert on deviations.

How to Mitigate CVE-2026-86490

Immediate Actions Required

Upgrade JetBrains YouTrack to version 2026.2.18634 or later without delay.
Audit existing YouTrack accounts and revoke unnecessary permissions, especially for shared or service accounts.
Inspect bundled apps for unauthorized modifications introduced before the upgrade.

Patch Information

JetBrains resolved this issue in YouTrack 2026.2.18634. The fix enforces correct permission checks on the app import endpoint so that only administrators can overwrite bundled apps. Release information is available on the JetBrains Security Fixes List.

Workarounds

Restrict network access to the YouTrack administrative interface using a reverse proxy or firewall until patching is complete.
Reduce the number of authenticated users on affected instances to trusted personnel only.
Monitor bundled app directories with file integrity monitoring to detect unauthorized changes.

bash

# Verify installed YouTrack version and confirm patched build
curl -s -H "Authorization: Bearer $YT_TOKEN" \
  https://youtrack.example.com/api/config | \
  grep -Ei '"version"|"build"'

# Expected: version at or above 2026.2.18634