External risk intelligence

JetBrains YouTrack Authorization Bypass Leads to Arbitrary Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-100273

JetBrains YouTrack is typically deployed as a web-based project management and issue-tracking application. Such systems are commonly exposed to the internet to facilitate remote access for distributed teams, making the web interface and associated services a common internet-facing attack surface.

Jetbrains Youtrack

before 2026.2.19197

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in JetBrains YouTrack, a project management and issue-tracking tool. An authorization bypass in the scripts debugger could allow unauthorized code execution, impacting systems that are internet-facing for remote access. The main concern is confirming relevance and exposure to this type of system.

Unauthorized code execution found in YouTrack.
Affects external-facing project management tools.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authorization controls in the YouTrack scripts debugger, leading to arbitrary code execution. This vulnerability is accessible over the network without requiring any prior authentication or user interaction, potentially allowing an attacker to compromise the entire system.

No prior authentication needed.
Scripts debugger authorization bypass.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an authorization bypass in the scripts debugger could allow for arbitrary code execution. This could potentially impact the integrity and availability of the YouTrack service.

System code execution.
Unauthenticated remote access.
Service compromise and data impact.

Operational Fix

Recommended remediation, mitigation, and detection steps

Identifying and remediating this authorization bypass vulnerability in JetBrains YouTrack requires coordination between the platform team managing the YouTrack instance and the application owners who use it for project management. The first practical step is to pinpoint all deployed YouTrack instances, confirm their accessibility, and determine which are business-critical, thereby identifying the accountable owners to plan targeted remediation.

Platform and application owners.
Verify YouTrack instance exposure and criticality.
Plan targeted updates based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is JetBrains YouTrack?

YouTrack is a web-based project management and issue-tracking platform used by teams to plan, track, and manage software development tasks. It functions as a central repository for technical documentation, bugs, and feature requests. Because it is designed to facilitate collaboration among distributed teams, organizations often host it as an accessible service to support remote workflows, which places it within the application layer of a corporate network.

How does CVE-2026-100273 cause a security weakness?

This vulnerability is an Improper Authorization issue, classified as CWE-863. In the context of this CVE, it means the YouTrack scripts debugger fails to properly verify if a user has permission to perform certain actions. By bypassing these authorization checks, an unauthorized party can execute arbitrary code on the underlying server, effectively allowing them to perform operations that should be restricted to authenticated administrators.

Do I need to be authenticated for this bug to be triggered?

No. A key characteristic of this vulnerability is that it does not require any prior authentication or user interaction to exploit. An attacker can initiate the exploit remotely over the network. It is important to note that this flaw specifically targets the scripts debugger component; standard interactions within the core project management interface that do not invoke the debugger are not the primary path for this specific trigger.

Why should I be concerned about my YouTrack deployment?

If your YouTrack instance is internet-facing, it is at higher risk because it is directly reachable by unauthorized network traffic. According to Halo Surface Signal, such applications are commonly exposed to the internet to support remote team access, making them a primary target. You should prioritize internal systems that house sensitive project data and assess their overall accessibility to confirm if they are exposed to the public internet.

What is the first step to address this vulnerability?

The immediate priority is to identify all deployed YouTrack instances within your environment. Work with your platform and application teams to verify the current version of each instance and confirm its network exposure. Once you have a clear inventory of your business-critical instances, coordinate with the respective system owners to schedule and apply the necessary updates to reach version 2026.2.19197 or later, which contains the fix for the authorization bypass.

References

www.jetbrains.com/privacy-security/issues-fixed/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.