PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-86489 JetBrains CVE debrief

CVE-2026-86489 is a medium-severity IDOR vulnerability in JetBrains YouTrack before version 2026.2.18634. The vulnerability allows for the disclosure of private issues and starred folders across organizations. Defenders responsible for YouTrack instances should assess exposure and prioritize verification and remediation efforts. The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being JetBrains. The NVD entry is currently Received. To verify exposure, defenders should review their YouTrack instances and assess the impact of private issues and starred folders disclosure.

Vendor
JetBrains
Product
YouTrack
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-07
Original CVE updated
2026-09-07
Advisory published
2026-09-07
Advisory updated
2026-09-07

Who should care

Defenders responsible for JetBrains YouTrack instances should assess exposure and prioritize verification and remediation efforts. This includes reviewing and updating YouTrack instances to version 2026.2.18634 or later, monitoring for potential unauthorized access to private issues and starred folders, and verifying the security of their YouTrack instances.

Why it matters

CVE-2026-86489 is a medium-severity vulnerability in JetBrains YouTrack that allows for the disclosure of private issues and starred folders across organizations. Defenders responsible for YouTrack instances should assess exposure, prioritize verification and remediation efforts, and update instances to version 2026.2.18634 or later.

  • Potential unauthorized access to private issues and starred folders
  • Need to verify exposure and assess impact in YouTrack instances
  • Priority on updating YouTrack instances to version 2026.2.18634 or later

Technical summary

CVE-2026-86489 is an IDOR vulnerability in the user profile API of JetBrains YouTrack before version 2026.2.18634. The vulnerability allows for the disclosure of private issues and starred folders across organizations. This could lead to potential unauthorized access to sensitive information. Defenders should prioritize verifying exposure in their YouTrack instances and assessing the impact of private issues and starred folders disclosure across organizations.

Defensive priority

Defenders should prioritize verifying exposure in their YouTrack instances and assessing the impact of private issues and starred folders disclosure across organizations.

Recommended defensive actions

  • Verify YouTrack instance exposure and assess impact of private issues and starred folders disclosure
  • Review and update YouTrack instance to version 2026.2.18634 or later
  • Monitor for potential unauthorized access to private issues and starred folders

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being JetBrains. The NVD entry is currently Received.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-86489 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-86489

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-86489 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-86489

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.