External risk intelligence

JetBrains YouTrack Helpdesk Improper Authentication Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-86478

JetBrains YouTrack Helpdesk is a service designed to be public-facing to receive and manage user-submitted support requests and communications, making its endpoints and authentication interfaces inherently accessible from the public internet in standard deployments.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An authentication flaw in JetBrains YouTrack Helpdesk could allow unauthorized individuals to take over accounts by submitting their own email addresses. This vulnerability impacts the integrity of user accounts and potentially the sensitive information they contain. The primary concern is to confirm if our organization uses this specific technology and is exposed.

Unauthenticated account takeover is possible.
Protects user accounts and associated data.
Confirm usage and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by targeting the JetBrains YouTrack Helpdesk, which is accessible over the network and does not require authentication. By manipulating the self-asserted email address feature, an attacker could potentially gain control of user accounts. This could lead to a complete compromise of user data and system access.

No authentication needed.
Self-asserted email feature exploited.
Risk of full account takeover.

Live Threat

Current exploitation, exposure, and threat context

When YouTrack Helpdesk's improper authentication is exploited, an attacker could gain unauthorized access to account information and potentially impersonate users. This could impact user data by exposing details submitted in support requests.

Account takeover.
Self-asserted email exposure.
Sensitive data compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in JetBrains YouTrack Helpdesk impacts unauthenticated account takeover, making it a critical concern for organizations using this product. The first practical step is to identify all instances of YouTrack Helpdesk, determine their external reachability and business criticality, and then locate the accountable system owners. Planning remediation should be risk-based, considering factors like exposure and business impact.

Application owners should manage the remediation.
Verify external reachability of YouTrack Helpdesk.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is JetBrains YouTrack and its Helpdesk feature?

YouTrack is a project management and issue-tracking platform developed by JetBrains. The Helpdesk component is a specialized feature within YouTrack designed to bridge the gap between internal teams and external customers. It allows organizations to receive, manage, and respond to incoming support requests and communications directly within the platform, effectively functioning as a help desk ticketing system.

What does improper authentication mean for CVE-2026-86478?

This vulnerability, classified as CWE-290 (Authentication Bypass by Spoofing), refers to a flaw where the system incorrectly verifies the identity of a user. In the context of this CVE, it means the YouTrack Helpdesk component fails to properly validate identity, allowing an unauthenticated person to manipulate their self-asserted email address to bypass security checks and gain unauthorized control over user accounts.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by interacting with the YouTrack Helpdesk interface. The vulnerability relies on the system's trust in the email address provided during the support request process. It is important to note that this does not require a complex bypass of traditional passwords; the vulnerability is specifically triggered through the misuse of the self-asserted email functionality itself, allowing the attacker to claim ownership of an account.

Is my instance of YouTrack Helpdesk at risk?

According to Halo Surface Signal, this vulnerability is highly relevant if your YouTrack Helpdesk is internet-facing. Because Helpdesk is designed to receive incoming requests from customers, these endpoints are often exposed to the public internet by default. If your instance is accessible from the network, it is a primary target, making it important to assess its specific configuration and external visibility.

What should I do first to address this CVE?

Start by identifying all instances of YouTrack Helpdesk within your infrastructure. Determine which of these are reachable from the internet and identify the system owners responsible for them. Once you have a clear inventory, prioritize these assets based on their business criticality and exposure to the network, and coordinate with the relevant team members to plan for the necessary updates.

References

www.jetbrains.com/privacy-security/issues-fixed/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.