PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-49385 JetBrains CVE debrief

A medium-severity improper access control vulnerability in JetBrains YouTrack before version 2026.1.13570 allows low-privileged users to modify service accounts. The vulnerability stems from missing authorization checks (CWE-862) that fail to restrict service account modification to administrative roles. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) indicates network-accessible attack vector with low attack complexity, requiring low privileges but no user interaction, resulting in high integrity impact with no confidentiality or availability impact. The vulnerability was published to NVD on May 29, 2026 and remains under analysis. JetBrains has addressed this issue in YouTrack 2026.1.13570.

Vendor
JetBrains
Product
YouTrack
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-22
Advisory published
2026-05-29
Advisory updated
2026-07-22

Who should care

Organizations running JetBrains YouTrack for issue tracking and project management, particularly those relying on service accounts for integrations and automated workflows. Security teams should prioritize patching to prevent unauthorized modification of service account credentials and permissions that could enable further lateral movement or data access.

Technical summary

The vulnerability exists in JetBrains YouTrack's access control implementation for service account management. Low-privileged authenticated users can bypass intended authorization restrictions to modify service account configurations. This represents a horizontal privilege escalation where standard user permissions are insufficiently enforced against sensitive administrative functions. The attack requires network access to the YouTrack instance and valid low-privilege credentials, with no additional user interaction needed. Successful exploitation compromises service account integrity without affecting system availability or exposing confidential data directly.

Defensive priority

medium

Recommended defensive actions

  • Upgrade JetBrains YouTrack to version 2026.1.13570 or later to remediate this vulnerability
  • Review service account modification audit logs for unauthorized changes in affected versions
  • Verify that service account management permissions are restricted to administrative roles after patching
  • Monitor for anomalous service account activity in YouTrack deployments running versions prior to 2026.1.13570

Evidence notes

The vulnerability description and affected version information are sourced from the official CVE record and NVD entry. The CWE-862 classification and CVSS vector are confirmed in NVD metadata. The fix version 2026.1.13570 is derived from the CVE description stating 'before 2026.1.13570'.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-49385 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-49385

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-49385 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-49385

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.