Executive Summary

A vulnerability in JetBrains YouTrack before versions 2025.3.156085, 2026.1.13914, and 2026.2.18095 allows an authenticated user to delete arbitrary entities via the mailbox endpoint due to missing authorization. This vulnerability has a CVSS score of 8.1, indicating high severity. Affected organizations should update to a patched version immediately.

Technical Analysis

Vulnerability Details

The vulnerability is classified as an authorization bypass issue (CWE-862). It exists in the mailbox endpoint of JetBrains YouTrack, where an authenticated user can delete arbitrary entities without proper authorization. The root cause is the lack of sufficient access control checks in the affected versions.

How It Gets Exploited

An authenticated user with a low-privileged account can exploit this vulnerability. The attacker would send a crafted request to the mailbox endpoint, targeting an entity they wish to delete. Due to the missing authorization check, the request would be processed without verifying the user's permissions, allowing the deletion of arbitrary entities. This could lead to significant data loss and disruption of service.

Impact Assessment

The vulnerability affects JetBrains YouTrack versions before 2025.3.156085, 2026.1.13914, and 2026.2.18095. An attacker can achieve high impact on integrity and availability, with CVSS metrics indicating a base score of 8.1. The confidentiality impact is none, but the ability to delete entities can lead to data loss and service disruption.

Recommended Actions

  • Update JetBrains YouTrack to version 2025.3.156085, 2026.1.13914, or 2026.2.18095, or later.
  • Restrict access to the mailbox endpoint for low-privileged users.
  • Monitor for suspicious activity on the mailbox endpoint.

Sources

  • National Vulnerability Database (NVD) - CVE-2026-75044
  • JetBrains YouTrack - Issues Fixed