CVE-2026-57923

In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.jetbrains.com/privacy-security/issues-fixed/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) En JetBrains YouTrack antes de 2026.2.16593, una autorización indebida en el endpoint de configuraciones de la aplicación permitió modificar la configuración del proyecto.

Information

Published : 2026-06-26 14:17

Updated : 2026-10-25 22:10

NVD link : CVE-2026-57923

Mitre link : CVE-2026-57923

CVE.ORG link : CVE-2026-57923

JSON object : View

Products Affected

jetbrains

youtrack

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-57923", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57923", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-26T13:27:33.706322Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@jetbrains.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@jetbrains.com", "affectedData": [{"vendor": "JetBrains", "product": "YouTrack", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.2.16593", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-26T14:17:07.030", "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/", "tags": ["Vendor Advisory"], "source": "cve@jetbrains.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cve@jetbrains.com", "description": [{"lang": "en", "value": "CWE-862"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings"}, {"lang": "es", "value": "En JetBrains YouTrack antes de 2026.2.16593, una autorizaci\u00f3n indebida en el endpoint de configuraciones de la aplicaci\u00f3n permiti\u00f3 modificar la configuraci\u00f3n del proyecto."}], "lastModified": "2026-10-25T22:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C45D6D89-194E-4494-A0B2-131DC8C6AF51", "versionEndExcluding": "2026.2.16593"}], "operator": "OR"}]}], "sourceIdentifier": "cve@jetbrains.com"}