PatchSiren cyber security CVE debrief

CVE-2026-49370 JetBrains CVE debrief

A low-severity information disclosure vulnerability in JetBrains YouTrack before version 2026.1.13162 allows authenticated administrators to inadvertently expose sensitive information through fetchApp requests. The vulnerability, published on May 29, 2026, carries a CVSS 3.1 score of 3.4 (Low severity) with the vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N. The attack requires high privileges (administrator access) and user interaction, limiting its practical exploitability. The weakness is categorized as CWE-201 (Insertion of Sensitive Information Into Sent Data). JetBrains has addressed this issue in YouTrack 2026.1.13162 and later versions.

Vendor: JetBrains
Product: YouTrack
CVSS: LOW 3.4
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-29
Original CVE updated: 2026-05-29
Advisory published: 2026-05-29
Advisory updated: 2026-05-29

Who should care

Organizations running JetBrains YouTrack for issue tracking and project management should prioritize this update, particularly those with multiple administrators or complex app integrations using fetchApp functionality. Security teams responsible for vulnerability management in development infrastructure should include this in routine patching cycles given its low severity but clear remediation path.

Technical summary

The vulnerability exists in the fetchApp request handling mechanism of JetBrains YouTrack versions prior to 2026.1.13162. When an authenticated administrator with high privileges performs specific fetchApp operations, sensitive information may be disclosed in the response. The attack surface is constrained by the requirement for administrative credentials and user interaction, resulting in a low CVSS score. The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), indicating that sensitive data is inadvertently included in outbound communications.

Defensive priority

routine

Recommended defensive actions

Upgrade JetBrains YouTrack to version 2026.1.13162 or later to remediate this information disclosure vulnerability
Review administrator access controls and audit fetchApp request patterns in YouTrack deployments
Monitor JetBrains security advisories for additional guidance on this and related issues
Verify that user interaction requirements for administrative functions are properly enforced in your YouTrack configuration

Evidence notes

The vulnerability affects JetBrains YouTrack, an issue tracking and project management platform. The information disclosure occurs specifically in fetchApp request handling. The CVSS scoring reflects limited impact due to the high privilege requirement (PR:H) and need for user interaction (UI:R).

Official resources

JetBrains disclosed this vulnerability through their standard security advisory process, with the issue documented in their issues-fixed security page.