CVE-2026-86499: JetBrains YouTrack Information Disclosure

CVE-2026-86499 Overview

CVE-2026-86499 is an information disclosure vulnerability in JetBrains YouTrack versions before 2026.1.14047. Predefined search fields leaked all group names to any authenticated user, regardless of that user's visibility permissions. The flaw maps to CWE-862: Missing Authorization, where the application exposed group metadata without enforcing the access controls that normally restrict this data.

The vulnerability requires low privileges and network access, but does not require user interaction. Impact is limited to confidentiality of group name data, with no integrity or availability consequences.

Critical Impact
Any authenticated YouTrack user could enumerate the names of all groups defined in the instance, exposing organizational structure and potentially aiding follow-on social engineering or targeted attacks.

Affected Products

JetBrains YouTrack versions before 2026.1.14047
YouTrack Server (self-hosted) deployments running affected builds
YouTrack InCloud instances prior to vendor-applied fix

Discovery Timeline

2026-09-07 - CVE-2026-86499 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86499

Vulnerability Analysis

The vulnerability resides in YouTrack's predefined search field functionality. Search fields that reference groups returned the full list of group names to the requesting user without checking whether that user had permission to view each group. The intended behavior is to filter group references based on the caller's visibility permissions, ensuring users only see groups they are authorized to know about.

Instead, the affected code path exposed all group names as part of predefined search field metadata. An authenticated attacker with any account, including a low-privilege guest or reporter role, could query these fields and enumerate group naming across the tenant. Group names in enterprise deployments often encode sensitive information such as project codenames, executive distribution lists, security team membership, or internal reorganization structures.

Root Cause

The root cause is missing authorization enforcement [CWE-862] in the code path serving predefined search field definitions. The endpoint returned group data from the underlying data store without applying the visibility filter that other YouTrack APIs use for group enumeration. This is a broken access control pattern where authentication was verified but per-object authorization was not.

Attack Vector

An attacker authenticates to a vulnerable YouTrack instance using any valid account. The attacker then interacts with the search interface or issues API requests that trigger predefined search field resolution. The response contains group names outside the caller's visibility scope. No specialized tooling, elevated privileges, or user interaction is required. See the JetBrains Fixed Security Issues page for vendor details.

Detection Methods for CVE-2026-86499

Indicators of Compromise

Elevated volume of authenticated API requests to YouTrack search or field-definition endpoints from a single user or token.
Low-privilege accounts issuing repeated queries that resolve predefined search fields referencing groups.
Access logs showing group enumeration patterns from accounts that do not typically administer groups.

Detection Strategies

Review YouTrack audit and access logs for anomalous read patterns against search field APIs, correlating request bursts with low-privilege accounts.
Baseline normal search field usage per user role and alert on deviations, particularly from newly created or guest accounts.
Compare the YouTrack build number reported by the running instance against 2026.1.14047 to identify unpatched deployments.

Monitoring Recommendations

Forward YouTrack application and access logs to a centralized SIEM for retention and correlation with authentication events.
Monitor for account creation followed shortly by search field enumeration activity, a common reconnaissance pattern.
Track outbound sharing of group names or internal directory structures in DLP and email security telemetry.

How to Mitigate CVE-2026-86499

Immediate Actions Required

Upgrade all YouTrack Server instances to version 2026.1.14047 or later without delay.
Verify that YouTrack InCloud tenants are running a fixed build; JetBrains applies updates automatically but confirm the version.
Audit existing user accounts and revoke unnecessary access, especially guest, reporter, and stale accounts that widen the pool of potential attackers.

Patch Information

JetBrains has addressed CVE-2026-86499 in YouTrack 2026.1.14047. The fix restores permission checks on predefined search fields so that group names are filtered according to the caller's visibility rights. Consult the JetBrains Fixed Security Issues page for the release entry and any additional guidance.

Workarounds

Restrict YouTrack access to trusted networks using firewall or reverse-proxy rules until the patch is applied.
Enforce strong authentication and disable self-registration to limit the population of accounts that can trigger the vulnerable code path.
Rename sensitive groups to remove information that would be damaging if disclosed, as a temporary compensating control.

bash

# Verify the running YouTrack version against the fixed build
curl -s -u <user>:<token> https://youtrack.example.com/api/config | \
  grep -Eo '"version":"[^"]+"'
# Upgrade if the reported version is below 2026.1.14047