SB20260907139 - Multiple vulnerabilities in YouTrack

Description

This security bulletin contains information about 3 vulnerabilities.

1) Incorrect Privilege Assignment (CVE-ID: CVE-2026-86500)

CWE-ID: CWE-266 - Incorrect Privilege Assignment

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to incorrect privilege assignment in the project role assignment functionality when assigning project roles. A remote user can grant themselves the Project Admin role to escalate privileges.

2) Missing Authorization (CVE-ID: CVE-2026-86499)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose group names.

The vulnerability exists due to missing authorization in predefined search fields when searching for groups. A remote user can use predefined search fields to disclose group names.

3) Incorrect authorization (CVE-ID: CVE-2026-86498)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify linked entities without update permission.

The vulnerability exists due to improper authorization in link sub-resources when processing PUT requests. A remote user can send a PUT request to modify linked entities without update permission.

Remediation

Install update from vendor's website.

References

• https://www.jetbrains.com/privacy-security/issues-fixed/#9431692b8e97fe31ddbae84753e05ffb
• https://www.jetbrains.com/privacy-security/issues-fixed/#f7d41bc695f7e13ed9d4fa2308ff01fb
• https://www.jetbrains.com/privacy-security/issues-fixed/#e9b45dcd821259814787b34055c8467e