CVE-2026-86493

Received Received - Intake

Improper Permission Checks in JetBrains YouTrack

Publication date: 2026-09-07

Last updated on: 2026-09-08

Assigner: JetBrains s.r.o.

Description

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-08

Generated

2026-09-28

AI Q&A

2026-09-07

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86493

EUVD

EUVD-2026-72509

Affected Vendors & Products

Vendor	Product	Version / Range
jetbrains	youtrack	to 2026.2.18634 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in JetBrains YouTrack before version 2026.2.18634 allows users with read-only permissions to create and modify whiteboard cards. Normally, read-only users should not have these capabilities.

Detection Guidance

This vulnerability involves improper permission checks in JetBrains YouTrack allowing read-only users to modify whiteboard cards. To detect it, check YouTrack user permissions and audit whiteboard card modifications by users with read-only roles. Review logs for unauthorized card creation or edits. No specific commands are provided in the context.

Impact Analysis

An attacker with read-only access could escalate privileges by creating or altering whiteboard cards, potentially leading to unauthorized data manipulation or exposure. The CVSS score of 6.5 indicates a medium severity risk.

Compliance Impact

This vulnerability allows read-only users to create and modify whiteboard cards, which could lead to unauthorized data access or manipulation. For GDPR, this may violate principles of data integrity and confidentiality. For HIPAA, it could compromise protected health information integrity if such data is involved.

Mitigation Strategies

Update JetBrains YouTrack to version 2026.2.18634 or later to address the improper permission checks affecting read-only users.

Hi! I’m here to help you understand CVE-2026-86493. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70