PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49370 JetBrains CVE debrief

A low-severity information disclosure vulnerability in JetBrains YouTrack before version 2026.1.13162 allows authenticated administrators to inadvertently expose sensitive information through fetchApp requests. The vulnerability, published on May 29, 2026, carries a CVSS 3.1 score of 3.4 (Low severity) with the vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N. The attack requires high privileges (administrator access) and user interaction, limiting its practical exploitability. The weakness is categorized as CWE-201 (Insertion of Sensitive Information Into Sent Data). JetBrains has addressed this issue in YouTrack 2026.1.13162 and later versions.

Vendor
JetBrains
Product
YouTrack
CVSS
LOW 3.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-22
Advisory published
2026-05-29
Advisory updated
2026-07-22

Who should care

Organizations running JetBrains YouTrack for issue tracking and project management should prioritize this update, particularly those with multiple administrators or complex app integrations using fetchApp functionality. Security teams responsible for vulnerability management in development infrastructure should include this in routine patching cycles given its low severity but clear remediation path.

Technical summary

The vulnerability exists in the fetchApp request handling mechanism of JetBrains YouTrack versions prior to 2026.1.13162. When an authenticated administrator with high privileges performs specific fetchApp operations, sensitive information may be disclosed in the response. The attack surface is constrained by the requirement for administrative credentials and user interaction, resulting in a low CVSS score. The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), indicating that sensitive data is inadvertently included in outbound communications.

Defensive priority

routine

Recommended defensive actions

  • Upgrade JetBrains YouTrack to version 2026.1.13162 or later to remediate this information disclosure vulnerability
  • Review administrator access controls and audit fetchApp request patterns in YouTrack deployments
  • Monitor JetBrains security advisories for additional guidance on this and related issues
  • Verify that user interaction requirements for administrative functions are properly enforced in your YouTrack configuration

Evidence notes

The vulnerability affects JetBrains YouTrack, an issue tracking and project management platform. The information disclosure occurs specifically in fetchApp request handling. The CVSS scoring reflects limited impact due to the high privilege requirement (PR:H) and need for user interaction (UI:R).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49370 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49370

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49370 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49370

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.