Authenticated User Account Enumeration in JetBrains YouTrack

Executive Summary

This vulnerability in JetBrains YouTrack before version 2026.2.18112 allows an authenticated user to enumerate existing accounts through the users search endpoint. This means an attacker with valid login credentials could potentially discover other usernames or account details in the system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves account enumeration via the users search endpoint in JetBrains YouTrack. To detect it, monitor network traffic for repeated requests to the /api/users/search endpoint. Check logs for unusual patterns of failed or successful account enumeration attempts. Ensure your YouTrack instance is updated to version 2026.2.18112 or later to mitigate this issue.

Useful 0 Not Useful 0

Impact Analysis

If you use JetBrains YouTrack before 2026.2.18112, an attacker with access could identify other user accounts in the system. This may lead to targeted phishing attempts, unauthorized access attempts, or information gathering for further attacks against specific users.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows enumeration of user accounts via an authenticated endpoint. This could potentially expose personal data, which may impact compliance with GDPR (data protection) and HIPAA (health information privacy) if user data is compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Update JetBrains YouTrack to version 2026.2.18112 or later to address the account enumeration vulnerability.

Useful 0 Not Useful 0