CVE-2026-75046

Executive Summary

CVE-2026-75046 is an account enumeration vulnerability in JetBrains YouTrack, an issue tracking and project management platform. An authenticated user of a vulnerable YouTrack instance (builds before 2026.2.18112) can enumerate other accounts through the users search endpoint, exposing the existence and identity of accounts they are not authorized to view. The flaw carries a CVSS base score of 4.3 (medium) and is classified as CWE-862 (Missing Authorization); while it does not directly expose credentials or enable code execution, it produces a reliable user inventory that materially lowers the barrier for credential stuffing, targeted phishing, and further lateral attacks.

Technical Analysis

The vulnerability is rooted in missing or insufficient authorization checks (CWE-862 — Missing Authorization) on the "users search endpoint" of JetBrains YouTrack. The NVD description states: "In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint."

Vulnerability mechanism. YouTrack exposes a search capability that allows users to query account records. In affected builds, this endpoint fails to enforce the requesting user's authorization scope over the result set. As a result, any authenticated user can issue search queries and determine whether specific accounts exist, or harvest lists of accounts, regardless of the permissions associated with their role. The behavior is characteristic of an authorization-bypass flaw rather than an injection flaw: the search functionality operates as designed, but the access-control check that should limit result visibility is absent or incorrectly applied.

Attack surface and prerequisites. The attack surface is any network-reachable YouTrack deployment. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) defines the prerequisites precisely: the attacker needs network access to the instance, no special attack conditions, a valid low-privileged account, and no user interaction. The scope is unchanged, meaning the flaw cannot pivot the attacker into a different security boundary. The confidentiality subscore is limited to low — consistent with disclosure of account identity information (user names, identifiers, possibly e-mail addresses) rather than full account records or credentials.

Technical detail availability. The NVD record is sparse. No CNA title, no vendor advisory, no patch source, and no code-level reference are available. The precise request schema, the URI path of the users search endpoint, and the affected code path cannot be derived from the provided data and must not be speculated. The only authoritative technical facts are: (1) the product (JetBrains YouTrack), (2) the vulnerable version boundary (before 2026.2.18112), and (3) the vulnerable component (the users search endpoint, exposed to authenticated users). Patch confidence is rated 0/4 — none of the tracked patch sources contain evidence that a fix is available — so defenders should treat all YouTrack builds prior to 2026.2.18112 as potentially affected until JetBrains publishes a confirming advisory.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code has been identified for CVE-2026-75046. The attack chain below is inferred from the vulnerability class (CWE-862, account enumeration via an application search endpoint) and the NVD description.

Step 1 — Reconnaissance and target identification. The attacker locates a publicly reachable YouTrack instance, e.g., via internet scanning for JetBrains YouTrack login pages, version banners, or characteristic API responses. Because the vulnerability requires a valid account (CVSS PR:L), the attacker either registers a low-privileged account (if self-registration is enabled), obtains legitimate credentials by other means, or uses an existing compromised account.

Step 2 — Flaw triggering. The attacker authenticates to the instance and submits search queries to the users search endpoint. Because the authorization check is missing, the endpoint returns account data beyond what the requesting principal should be able to retrieve. The attacker can systematically vary search terms — candidate user names, partial strings, or pattern-based queries — and observe which terms return matches. This creates an oracle condition: each HTTP request reveals whether a given account exists.

Step 3 — Payload and execution method. At the vulnerability-class level, the technique is HTTP request manipulation rather than injection or memory corruption. The attacker sends crafted, legitimate requests to the users search endpoint, supplying query parameters designed to elicit account records. The application executes the query on behalf of the authenticated user without verifying the user's entitlement to the full result set. No shellcode, SQL payload, or deserialization content is involved; the sole enabler is the absence of an authorization predicate in the endpoint's request-handling path.

Step 4 — Post-exploitation impact. The attacker compiles a validated list of user names and associated identifiers. This inventory feeds directly into credential-stuffing campaigns (reusing credentials leaked from other breaches), targeted phishing against identified staff, social-engineering pretexts referencing internal account names, and abuse of password-reset or account-recovery flows that reveal additional account metadata. The direct confidentiality loss is low per the CVSS score, but the indirect value of a verified user list is significant to adversaries and is the reason this CVE warrants monitoring despite its moderate score.

There is no evidence of in-the-wild exploitation or an associated threat-actor campaign at the time of writing; CISA KEV does not include this CVE.

Impact Assessment

Business impact. YouTrack deployments commonly hold project metadata, issue trackers, and the user directories of engineering, product, and security teams. The enumeration flaw exposes which accounts exist in those directories, enabling highly targeted follow-on attacks against individuals. For organizations running internet-facing YouTrack instances, the immediate risk is elevated because the prerequisite — an authenticated account — can often be satisfied through self-registration or low-privilege credentials. For internal-only deployments, the risk is reduced but persists because any internal user with a valid YouTrack account can perform the enumeration.

Affected systems and blast radius. All YouTrack deployments running builds prior to 2026.2.18112 are within the vulnerable range. Given the absence of an enumerated affected-version list, the conservative assumption is that every older build, including long-term supported releases, may be affected until JetBrains clarifies the scope. The blast radius at the data level is restricted to account identity information; the CVSS confidentiality subscore is LOW (C:L), while integrity and availability are rated NONE.

CVSS contextual note. The score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects a low direct impact. Defenders should nonetheless treat this as a reconnaissance enabler: in combination with other CVEs or weak authentication hygiene, the enumerated account list can amplify the impact of credential-based attacks. The vulnerability does not cross trust boundaries (S:U), so its exploitation does not grant access to other systems by itself.

Detection Guidance

Detection should focus on behavioral patterns: repeated, systematic queries against the users search endpoint from a single authenticated session or source IP, statistically anomalous request volumes, and variations in response sizes or status codes consistent with an enumeration oracle. Because YouTrack traffic is typically HTTPS, the rules below are most effective when applied at reverse proxies, WAFs, or TLS-terminating load balancers where decrypted request and response data is available. Adapt the generic URI pattern ("users" and "search" tokens) to the exact path structure observed in your environment; do not assume a specific endpoint path, as it is not disclosed in the NVD description.

Sigma Rule

title: JetBrains YouTrack User Enumeration via Users Search Endpoint
id: b68f0a1c-7d3a-4f9e-8c2b-1a2b3c4d5e6f
status: experimental
description: >-
    Detects a high frequency of authenticated HTTP 200 responses referencing the
    users search endpoint in JetBrains YouTrack, consistent with account
    enumeration behavior described for CVE-2026-75046.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75046
    - https://cwe.mitre.org/data/definitions/862.html
author: Valter Security Research
date: 2026/05/28
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains|all:
            - 'users'
            - 'search'
        sc-status: 200
    condition: selection | count() by c-ip, cs-username > 30
timeframe: 5m
level: medium
tags:
    - attack.discovery
    - attack.t1087
    - cve-2026-75046

YARA Rule

rule Youtrack_CVE_2026_75046_Enumeration_Artifacts
{
    meta:
        author = "Valter Security Research"
        description = "Detects access-log or HTTP-capture artifacts containing repeated references to the JetBrains YouTrack users search endpoint, indicative of CVE-2026-75046 enumeration activity"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75046"
        cve = "CVE-2026-75046"
        date = "2026-05-28"
        severity = "medium"

    strings:
        $s_users = "users" ascii nocase
        $s_search = "search" ascii nocase
        $s_youtrack = "youtrack" ascii nocase
        $s_200 = " 200 " ascii

    condition:
        filesize < 20MB and
        #s_users >= 10 and
        $s_search and
        ($s_youtrack or #s_200 >= 10)
}

Suricata IDS Rule

alert http any any -> any any (msg:"JetBrains YouTrack users search endpoint enumeration attempt (CVE-2026-75046)"; flow:established,to_server; http.uri; content:"users"; nocase; http.uri; content:"search"; nocase; threshold: type both, track by_src_ip, count 25, seconds 120; reference:cve,2026-75046; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-75046; classtype:attempted-recon; sid:202675046; rev:1;)

Deployment note: this rule matches on the URI path only and assumes decrypted HTTP visibility. In TLS-only deployments, enable a TLS inspection policy at the proxy or apply the rule to reverse-proxy access logs instead. The threshold suppresses noise from low-volume legitimate use; tune the count and seconds values to your baseline.

Elastic Detection

Base EQL rule — flags any authenticated request to the users search endpoint; pair with a threshold aggregation for enumeration:

any where network.protocol == "http" and
  http.request.method == "GET" and
  http.request.uri_full like "*users*search*" and
  http.response.status_code == 200

Correlation variant — sequence of multiple distinct search queries from one source within five minutes (requires event correlation over the base hits):

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and http.request.uri_full like "*users*search*" and http.response.status_code == 200 ]
  [ network where network.protocol == "http" and http.request.uri_full like "*users*search*" and http.response.status_code == 200 ]
  [ network where network.protocol == "http" and http.request.uri_full like "*users*search*" and http.response.status_code == 200 ]

Because EQL expresses sequences rather than frequency thresholds, run the base rule in a detection engine that supports aggregation (e.g., Elastic Security custom query with a > 30 occurrences in 5m condition) to implement the volumetric component.

Splunk SPL Query

index=* sourcetype=access_*
| regex uri="(?i)(users.*search|search.*users)"
| eval src_user=coalesce(user, cs_username, "unknown")
| bin _time span=5m
| stats count as search_requests, dc(uri) as distinct_queries by src_ip, src_user, _time
| where search_requests > 30 AND distinct_queries > 5
| eval alert="possible JetBrains YouTrack account enumeration (CVE-2026-75046)"
| table _time src_ip src_user search_requests distinct_queries alert
| sort - search_requests

Known consideration: search-request volume varies by team size and tooling usage; organizations with heavy legitimate search activity should baseline normal per-user query counts and adjust the threshold accordingly to avoid alert fatigue.

Wazuh OSSEC Rule

<group name="youtrack,">
  <rule id="100501" level="8">
    <decoded_as>web-access</decoded_as>
    <match>users</match>
    <match>search</match>
    <description>JetBrains YouTrack users search endpoint accessed repeatedly - possible account enumeration (CVE-2026-75046)</description>
    <group>attack.discovery,t1087,cve-2026-75046,</group>
    <mitre>
      <id>T1087</id>
    </mitre>
    <frequency>30</frequency>
    <timeframe>300</timeframe>
    <same_source_ip />
  </rule>
</group>

The rule fires when 30 events referencing both "users" and "search" arrive from the same source IP within 300 seconds. Verify that your Wazuh decoder maps the web-server access log fields (source IP, URI, status code) correctly for your YouTrack reverse-proxy deployment.

Mitigation & Patch Guidance

Patch confidence is 0/4: no vendor advisory, patch source, or confirmed fixed build has been tracked. Operationally, this means the verified path is mitigation, not patching. The version boundary "before 2026.2.18112" in the NVD description is the only indication of a remediation build, and it must be confirmed through official JetBrains release channels before deployment.

1) Immediate mitigations (apply now).

• Restrict access to the users search endpoint at the reverse proxy, WAF, or load balancer. If selective blocking is not possible, restrict console access to trusted networks or VPN ranges.
• Enforce multi-factor authentication (MFA) for all YouTrack accounts to reduce the likelihood that low-privilege or self-registered accounts are available to untrusted parties.
• Disable self-registration if it is enabled; provision accounts only through administrative processes tied to verified identity.
• Deploy an alerting rule (Sigma/EQL/SPL/Wazuh as provided above) tuned to your baseline to detect bursts of users search requests and investigate them as early-warning signals.

2) Patch and upgrade steps.

• Monitor JetBrains YouTrack release notes and the JetBrains security advisory feed for confirmation that build 2026.2.18112 (or a later build) contains the fix.
• Once confirmed, upgrade all affected YouTrack instances to 2026.2.18112 or newer. Follow a staged rollout: snapshot/backup the instance and its database, upgrade in a staging environment, verify the users search endpoint behavior is corrected, then promote to production.
• Re-verify the version on all internet-facing hosts after the upgrade to ensure no instance remains on a pre-fix build.

3) Long-term hardening.

• Apply the principle of least privilege to YouTrack roles; audit which roles can invoke search endpoints and restrict search scope to the minimum required for each role.
• Review authorization logic on all search, export, and bulk-query endpoints during development and in code review, treating user enumeration as an unacceptable side effect.
• Segment YouTrack from the open internet where possible; if external access is required, place it behind SSO with MFA and a WAF policy that rate-limits authenticated API requests.
• Subscribe to CVE and vendor notifications for JetBrains products and incorporate YouTrack into the vulnerability-management workflow so future fixes are applied within the organization's SLA.
• Retain and centrally log reverse-proxy access data for YouTrack to support future retroactive analysis if additional enumeration or exploitation evidence emerges.

References

1. NVD entry for CVE-2026-75046 — https://nvd.nist.gov/vuln/detail/CVE-2026-75046
2. CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
3. MITRE ATT&CK Technique T1087: Account Discovery — https://attack.mitre.org/techniques/T1087/
4. JetBrains YouTrack product and release notes (vendor reference; advisory not yet identified) — https://www.jetbrains.com/youtrack/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-75046 not listed at the time of writing) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

At the time of writing, there is no known threat-actor campaign, no public exploit code, and no evidence of exploitation in the wild for CVE-2026-75046. This assessment is subject to change as new patch or advisory data becomes available; monitor the NVD entry and JetBrains release channels.