PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-75046 JetBrains CVE debrief

CVE-2026-75046 debrief: JetBrains YouTrack authenticated user account enumeration via users search endpoint. This vulnerability allows an authenticated user to enumerate accounts, potentially leading to unauthorized access or further exploitation. Defenders should assess exposure and implement compensating controls to limit account enumeration. The vulnerability has a CVSS score of 4.3 and a severity of MEDIUM. It is essential to verify the affected versions and exposure to prevent potential abuse.

Vendor
JetBrains
Product
YouTrack
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-17
Original CVE updated
2026-09-15
Advisory published
2026-08-17
Advisory updated
2026-09-15

Who should care

Defenders responsible for JetBrains YouTrack instances should assess exposure and implement compensating controls to limit account enumeration.

Why it matters

CVE-2026-75046 allows authenticated users to enumerate accounts in JetBrains YouTrack via the users search endpoint. Defenders should verify exposure, implement compensating controls, and monitor for potential abuse.

  • Potential account enumeration by authenticated users
  • Possible abuse of the users search endpoint
  • Need for verification of affected versions and exposure

Technical summary

CVE-2026-75046 is a vulnerability in JetBrains YouTrack that allows an authenticated user to enumerate accounts via the users search endpoint. The vulnerability has a CVSS score of 4.3 and a severity of MEDIUM. It is crucial to understand the affected product context and defensive impact to implement effective security measures. The vulnerability can be exploited by authenticated users with search access, emphasizing the need for compensating controls and monitoring.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls for authenticated users with search access.

Recommended defensive actions

  • Verify exposure of YouTrack instances to authenticated users with search access
  • Implement compensating controls to limit account enumeration
  • Monitor for potential abuse of the users search endpoint

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further verification is required to determine the full scope of affected versions and potential impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-75046 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-75046

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-75046 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-75046

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.