CVE-2026-75046 JetBrains CVE debrief

Who should care

Defenders responsible for JetBrains YouTrack instances, particularly those with authenticated user access to the users search endpoint, should assess exposure and implement compensating controls.

Why it matters

CVE-2026-75046 allows authenticated users to enumerate accounts in JetBrains YouTrack instances via the users search endpoint. Defenders should verify exposure, implement compensating controls, and monitor for potential enumeration attempts.

• Potential enumeration of accounts by authenticated users
• Need for verification of exposure in JetBrains YouTrack instances
• Implementation of compensating controls for authenticated users
• Monitoring for potential enumeration attempts

Technical summary

CVE-2026-75046 is a vulnerability in JetBrains YouTrack before version 2026.2.18112 that allows authenticated users to enumerate accounts via the users search endpoint. This vulnerability affects JetBrains YouTrack instances with authenticated user access to the users search endpoint. Defenders should prioritize verifying exposure and implementing compensating controls for authenticated users with access to the endpoint.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls for authenticated users with access to the users search endpoint in JetBrains YouTrack instances.

Recommended defensive actions

• Verify JetBrains YouTrack instances for exposure to the users search endpoint
• Implement compensating controls for authenticated users with access to the endpoint
• Monitor for potential enumeration attempts

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary details coming from the vendor advisory. Evidence is limited to official CVE Program and NVD records. No additional information or claims are made. Defenders should verify exposure in their JetBrains YouTrack instances and implement compensating controls for authenticated users with access to the users search endpoint.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.