PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-75044 JetBrains CVE debrief

CVE-2026-75044 debrief based on the supplied source corpus. The CVE record was published on 2026-08-17T16:17:51.410Z and was last modified on 2026-09-15T17:46:57.947Z. The NVD entry is currently Analyzed. Defenders and administrators of JetBrains YouTrack installations should assess exposure and potential impact, focusing on authenticated users with mailbox access. The vulnerability allows an authenticated user to delete arbitrary entities via the mailbox endpoint due to missing authorization. This could lead to potential data loss or corruption, increased risk of malicious activity, and disruption to business operations. Defenders should prioritize verifying exposure and assessing

Vendor
JetBrains
Product
YouTrack
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-17
Original CVE updated
2026-09-15
Advisory published
2026-08-17
Advisory updated
2026-09-15

Who should care

Defenders and administrators of JetBrains YouTrack installations should assess exposure and potential impact, focusing on authenticated users with mailbox access.

Why it matters

CVE-2026-75044 is a high-severity vulnerability in JetBrains YouTrack that allows authenticated users to delete arbitrary entities via the mailbox endpoint. Defenders should prioritize verifying exposure and assessing potential impact, focusing on authenticated users with mailbox access.

  • Potential data loss or corruption due to unauthorized entity deletion
  • Increased risk of malicious activity by authenticated users
  • Need for verification of exposure and assessment of potential impact
  • Potential disruption to business operations or services

Technical summary

The vulnerability in JetBrains YouTrack allows an authenticated user to delete arbitrary entities via the mailbox endpoint due to missing authorization. This could lead to potential data loss or corruption, increased risk of malicious activity, and disruption to business operations. The affected versions are before 2025.3.156085, 2026.1.13914, and 2026.2.18095. Defenders should prioritize verifying exposure and assessing potential impact, focusing on authenticated users with mailbox access.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on authenticated users with mailbox access.

Recommended defensive actions

  • Verify exposure by checking YouTrack versions and mailbox endpoint access
  • Assess potential impact on authenticated users with mailbox access
  • Implement compensating controls to limit mailbox endpoint access
  • Monitor for suspicious activity related to mailbox endpoint usage

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its CVSS score and affected versions. The vulnerability is in JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095. The NVD entry is currently Analyzed. Evidence is limited to CVE and NVD details. Defenders should verify exposure and assess potential impact based on available information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-75044 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-75044

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-75044 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-75044

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.