CVE-2026-75044

Executive Summary

CVE-2026-75044 is a missing-authorization vulnerability (CWE-862) in JetBrains YouTrack, the company's issue-tracking and project-management platform. An authenticated user can leverage the mailbox endpoint to delete arbitrary entities without the required authorization, affecting all self-hosted YouTrack instances running builds prior to 2025.3.156085, 2026.1.13914, and 2026.2.18095. With a CVSS 3.1 base score of 8.1, the flaw enables high-impact integrity and availability loss — namely, targeted destruction of issues, project metadata, and tracked work items by a low-privileged, unauthenticated-interaction-free remote attacker.

Technical Analysis

The vulnerability resides in the integration surface known as the mailbox endpoint — the component that processes inbound email and links messages to YouTrack entities. The NVD description provides no function names, request paths, or parameter details, so the analysis below is constrained to what is explicitly disclosed.

At its core, this is a classic missing authorization flaw (CWE-862). The application fails to enforce an authorization check before performing a destructive operation. Specifically, an authenticated user can issue a deletion request through the mailbox endpoint, and the handler acts on the supplied entity reference without verifying that the requesting principal owns the entity, belongs to the owning project, or possesses an administrative role. Because the endpoint historically accepts mailbox-originated commands on behalf of authenticated sessions, the trust boundary between "email integration processing" and "user-initiated destructive action" is not enforced.

Attack surface characteristics:

• Network exposure: The mailbox endpoint is reachable over the network (AV:N), meaning a standard HTTPS request is sufficient.
• Authentication requirement: The attacker must possess any valid YouTrack account (PR:L). No administrator privileges are required.
• No user interaction: The victim does not need to click anything or approve the action (UI:N).
• Impact symmetry: The CVSS vector shows no confidentiality impact (C:N) but very high integrity and availability impact (I:H, A:H). This indicates the flaw is not about reading data — it is about destroying it.

The missing-authorization class is distinct from privilege escalation via injection. There is no evidence of SQL injection, command injection, or authentication bypass. The vulnerability is a straightforward broken access-control condition: the mailbox handler trusts the caller's identity without validating the caller's permissions against the target entity. The "arbitrary entities" wording implies that the deletion scope spans any entity type managed by YouTrack — issues, comments, attachments, or project configurations — across all projects, not just those owned by the authenticated user.

It is important to note that the NVD description is sparse. Insufficient technical detail is available to reconstruct the exact code path, request structure, or HTTP method. Security teams should treat any request pattern that targets the mailbox endpoint with deletion intent as suspicious until a vendor advisory provides precise indicators.

Exploitation Scenarios

No public PoC or exploit code has been identified for CVE-2026-75044. The attack chain below is inferred from the vulnerability class (CWE-862) and the disclosed component (mailbox endpoint). Attack steps:

1. Reconnaissance and target identification. An attacker scans the internet for exposed YouTrack instances using search-engine dorks (e.g., http.title:"YouTrack") or service fingerprinting. Once an instance is found, the attacker fingerprints the build version by inspecting the login page, bundled resources, or API metadata to confirm it falls in the affected range (before 2025.3.156085, 2026.1.13914, or 2026.2.18095).

2. Gaining an authenticated foothold. The attacker obtains a valid low-privileged account. Realistic acquisition paths include credential stuffing against self-hosted instances, default credentials left in place, or self-registration if the deployment allows open signup. The CVSS vector (PR:L) explicitly confirms that the lowest privilege level is sufficient; no administrative session is needed.

3. Triggering the flawed authorization check. The attacker authenticates to the mailbox endpoint and issues a deletion request. Because the endpoint lacks an authorization check, it processes the request if the attacker-supplied entity identifiers are valid, even if the entities belong to other users or projects. Endpoint-specific parameters are not disclosed, so the exact payload cannot be described; at the class level, the request is a destructive operation (delete) targeting mailbox-associated entity identifiers.

4. Post-exploitation impact. Each successful request permanently removes the targeted entity. Repeated requests allow mass deletion — the attacker can wipe issue trackers, sprint boards, knowledge-base articles, and audit trails. This creates both an integrity loss (project history is falsified by absence) and an availability loss (the instance becomes unreliable or incomplete). Because deletion is frequently irreversible in such systems, recovery may require database restoration from backups, incurring downtime.

The absence of a public PoC does not reduce the severity. Missing-authorization flaws of this type are trivial to weaponize once the endpoint request format is reverse-engineered, which a motivated attacker can do with API traffic inspection.

Impact Assessment

Business impact. JetBrains YouTrack is used by development teams as the source of truth for planning, issue triage, and release tracking. The ability to delete arbitrary entities converts any compromised low-privileged account into a data-destruction tool. Business consequences include:

• Permanent loss of issue history — legal, regulatory, or contractual records tied to project tracking are destroyed.
• Operational disruption — sprint plans, backlog grooming artifacts, and release notes are damaged or missing, halting development workflows.
• Trust erosion — customers and internal stakeholders lose confidence in the integrity of project data.
• Recovery costs — restoration from backups leads to downtime and potential data loss for the period between the last backup and the attack.

Affected systems. Self-hosted YouTrack deployments running builds before 2025.3.156085, 2026.1.13914, and 2026.2.18095. JetBrains-hosted (cloud) YouTrack instances are assumed to be patched by the vendor; the risk concentrates on on-premises/self-managed installations where the operator is responsible for upgrades.

Blast radius. CVSS subscores: Attack Vector: Network (AV:N), Attack Complexity: Low (AC:L), Privileges Required: Low (PR:L), User Interaction: None (UI:N), Scope: Unchanged (S:U), Confidentiality: None (C:N), Integrity: High (I:H), Availability: High (A:H). The base score of 8.1 places this in the High severity band. The blast radius is broad because any authenticated user — including contractors, external partners, or customers given portal accounts — can target entities across the entire instance, not just their own project. The lack of confidentiality impact suggests the attacker cannot read data, which reduces the likelihood of data theft but not the severity of destructive impact. If the deployment is internet-facing and uses a shared account database, a single compromised credential is sufficient to initiate a denial-of-service campaign against project data.

At the time of writing, EPSS has not been scored by FIRST.org, CISA has not added this CVE to the Known Exploited Vulnerabilities (KEV) catalog, and there is no evidence of exploitation in the wild.

Detection Guidance

Detection for this vulnerability is challenging because the request patterns are not fully disclosed. The rules below focus on the only concrete indicator available: destructive HTTP methods directed at the mailbox endpoint, combined with authenticated sessions originating from unusual principals. Tune these rules to your environment once a vendor advisory clarifies the exact endpoint path.

Sigma Rule

title: JetBrains YouTrack Mailbox Endpoint Unauthorized Deletion
id: 6b3c9f1e-4c72-4d9a-9e11-0b5c8f2a1d44
status: experimental
description: Detects HTTP requests targeting the YouTrack mailbox endpoint with deletion methods, potentially indicating CVE-2026-75044 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75044
author: Threat Intelligence Team
date: 2026/06/01
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026.75044
logsource:
    category: webserver
    product: generic
detection:
    selection_method:
        http.method:
            - 'DELETE'
            - 'POST'
    selection_uri:
        http.url|contains|all:
            - 'mailbox'
            - 'delete'
    selection_status:
        http.response.status_code:
            - 200
            - 202
            - 204
    condition: selection_method and selection_uri and selection_status
    timeframe: 5m
falsepositives:
    - Legitimate administrative cleanup tasks using the mailbox endpoint
    - Internal integrations that legitimately delete processed mail
level: high

YARA Rule

rule JetBrains_YouTrack_CVE_2026_75044
{
    meta:
        author = "Threat Intelligence Team"
        description = "Detects log artifacts and web captures referencing CVE-2026-75044 and YouTrack mailbox deletion activity"
        cve = "2026-75044"
        date = "2026-06-01"
        severity = "high"
    strings:
        $cve = "CVE-2026-75044" ascii wide nocase
        $endpoint = "mailbox" ascii wide nocase
        $action = "delete" ascii wide nocase
        $ver_1 = "2025.3." ascii wide
        $ver_2 = "2026.1." ascii wide
        $ver_3 = "2026.2." ascii wide
        $product = "YouTrack" ascii wide nocase
    condition:
        (
            $cve and $endpoint and $action
        ) or (
            $product and $endpoint and $action and (
                $ver_1 or $ver_2 or $ver_3
            )
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT JetBrains YouTrack Mailbox Endpoint Unauthorized Deletion Attempt (CVE-2026-75044)"; flow:to_server,established; content:"mailbox"; http.uri; nocase; content:"delete"; http.uri; nocase; pcre:"/(delete|remove)/i"; http.method; content:"DELETE"; http.method; offset:0; classtype:attempted-dos; sid:7504401; rev:1; metadata:created_at 2026_06_01, updated_at 2026_06_01, cve 2026_75044;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.category == "web"
      and http.request.method in ("DELETE", "POST")
      and wildcard(url.path, "*mailbox*")
      and http.request.referrer != null ]
  [ network where event.category == "web"
      and http.response.status_code in (200, 202, 204)
      and wildcard(url.path, "*mailbox*") ]

This EQL query looks for an authenticated caller first issuing a destructive request to the mailbox endpoint and then receiving a success response within a short window — a strong signal of successful deletion. Add a second condition on source.user.name to restrict the search to low-privileged accounts if role metadata is available in your index.

Splunk SPL Query

index=* sourcetype=access_combined
| where method IN ("DELETE", "POST") AND uri_path LIKE "%mailbox%"
| eval suspicious = if(like(uri_query, "%delete%") OR like(uri_path, "%delete%"), "yes", "no")
| stats count by src_ip, user, uri_path, status, suspicious
| where suspicious = "yes" OR count > 20
| sort - count
| table _time, src_ip, user, uri_path, status, count

Run this query across your web-access logs (Apache, Nginx, IIS, or a reverse proxy in front of YouTrack). Anomalous spikes of DELETE/POST operations to mailbox paths from a single low-privileged user should be investigated immediately. Adjust the index and sourcetype to match your data onboarding.

Wazuh OSSEC Rule

<rule id="100750" level="12">
  <decoded>mailbox</decoded>
  <match>mailbox</match>
  <regex>DELETE|POST</regex>
  <description>JetBrains YouTrack: Possible unauthorized deletion via mailbox endpoint (CVE-2026-75044)</description>
  <group>app,vulnerability,access_control,web_application,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
</rule>

Place this rule in a local rules file (/var/ossec/etc/rules/local_rules.xml), restart the Wazuh manager, and confirm that your decoder is extracting the HTTP method and URI from the YouTrack reverse-proxy logs. Tune the regex to your exact log format to avoid false positives from unrelated mailbox traffic.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — no patch evidence from any tracked source was captured at the time of this report. Note the inconsistency: the NVD description embeds fixed build numbers (2025.3.156085, 2026.1.13914, 2026.2.18095), which implies JetBrains has released remediating builds, yet our patch-tracking sources have not corroborated this. Verify directly with JetBrains support or the official YouTrack changelog before treating the instance as fixed.

1. Immediate mitigations (operator-controlled):

   • Restrict network access to the mailbox endpoint at the reverse proxy or firewall layer. Allow only the mail server IP addresses that legitimately deliver inbound messages to YouTrack.
   • Enforce least privilege: audit and disable dormant accounts, and revoke access for contractors and external collaborators until the instance is patched.
   • Place the YouTrack web application behind a WAF with a block rule for destructive methods (DELETE) targeting mailbox-related paths.
   • Enable verbose audit logging on the application and reverse proxy to capture successful deletion requests for forensic purposes.
   • Take a verified full backup (database + attachments) before any remediation activity, and test the restore procedure.

2. Patch/upgrade steps:

   • Upgrade self-hosted YouTrack to build 2025.3.156085, 2026.1.13914, or 2026.2.18095 (or any later build) per the NVD description. Until a formal JetBrains advisory is published, validate the fixed version against the official YouTrack release notes.
   • If you cannot upgrade immediately, consider disabling the mailbox integration feature entirely (inbound email processing) if business workflows permit.
   • After upgrading, verify the fix by attempting to delete an entity owned by another user via the mailbox endpoint in a test environment.

3. Long-term hardening:

   • Establish a patch-management SLA for self-hosted JetBrains products; YouTrack has historically been a target for access-control CVEs.
   • Implement periodic authorization audits: review role assignments, API token usage, and service accounts with mailbox access.
   • Monitor CISA KEV and FIRST.org EPSS feeds as they begin scoring this CVE; revisit priority if exploitation-in-the-wild is confirmed.
   • Prepare an incident-response runbook for destructive access-control incidents, including database restoration from backups and entity-level recovery procedures.

References

1. NVD Entry — CVE-2026-75044: https://nvd.nist.gov/vuln/detail/CVE-2026-75044
2. MITRE CVE Record — CVE-2026-75044: https://www.cve.org/CVERecord?id=CVE-2026-75044
3. JetBrains YouTrack Issue Tracker / Official Site: https://www.jetbrains.com/youtrack/ (check the "What's New" and security bulletins pages for the forthcoming vendor advisory)
4. MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
5. CISA Known Exploited Vulnerabilities Catalog (not currently listing CVE-2026-75044): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploitation-in-the-wild evidence: None identified at the time of writing. No public PoC, no Nuclei template, and no exploit code has been observed. EPSS has not yet been scored by FIRST.org. This report will require revision if JetBrains publishes an advisory, a public PoC emerges, or CISA adds the CVE to the KEV catalog.