PatchSiren cyber security CVE debrief

CVE-2026-49385 JetBrains CVE debrief

A medium-severity improper access control vulnerability in JetBrains YouTrack before version 2026.1.13570 allows low-privileged users to modify service accounts. The vulnerability stems from missing authorization checks (CWE-862) that fail to restrict service account modification to administrative roles. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) indicates network-accessible attack vector with low attack complexity, requiring low privileges but no user interaction, resulting in high integrity impact with no confidentiality or availability impact. The vulnerability was published to NVD on May 29, 2026 and remains under analysis. JetBrains has addressed this issue in YouTrack 2026.1.13570.

Vendor: JetBrains
Product: YouTrack
CVSS: MEDIUM 6.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-29
Original CVE updated: 2026-05-29
Advisory published: 2026-05-29
Advisory updated: 2026-05-29

Who should care

Organizations running JetBrains YouTrack for issue tracking and project management, particularly those relying on service accounts for integrations and automated workflows. Security teams should prioritize patching to prevent unauthorized modification of service account credentials and permissions that could enable further lateral movement or data access.

Technical summary

The vulnerability exists in JetBrains YouTrack's access control implementation for service account management. Low-privileged authenticated users can bypass intended authorization restrictions to modify service account configurations. This represents a horizontal privilege escalation where standard user permissions are insufficiently enforced against sensitive administrative functions. The attack requires network access to the YouTrack instance and valid low-privilege credentials, with no additional user interaction needed. Successful exploitation compromises service account integrity without affecting system availability or exposing confidential data directly.

Defensive priority

medium

Recommended defensive actions

Upgrade JetBrains YouTrack to version 2026.1.13570 or later to remediate this vulnerability
Review service account modification audit logs for unauthorized changes in affected versions
Verify that service account management permissions are restricted to administrative roles after patching
Monitor for anomalous service account activity in YouTrack deployments running versions prior to 2026.1.13570

Evidence notes

The vulnerability description and affected version information are sourced from the official CVE record and NVD entry. The CWE-862 classification and CVSS vector are confirmed in NVD metadata. The fix version 2026.1.13570 is derived from the CVE description stating 'before 2026.1.13570'.

Official resources

JetBrains disclosed this vulnerability through their security issues fixed page on May 29, 2026. The CVE was assigned and published to NVD the same day. No known exploitation in the wild has been reported, and the vulnerability is not on C.