CVE-2026-75049

Executive Summary

CVE-2026-75049 is a missing-authorization vulnerability (CWE-862) in JetBrains YouTrack, a widely used project management and issue-tracking platform. An authenticated low-privileged user can read restricted knowledge-base articles belonging to other projects by interacting with the draft creation endpoint — a horizontal privilege escalation that results in unauthorized information disclosure. YouTrack instances prior to builds 2026.1.13903 and 2026.2.17950 are affected; the vulnerability carries a CVSS v3.1 base score of 6.5 (High Confidentiality, no Integrity or Availability impact) and is not listed on CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

The vulnerability is an instance of CWE-862 (Missing Authorization). The flaw exists in the YouTrack draft creation feature. YouTrack maintains a knowledge-base subsystem in which "articles" (help-desk and project documentation entries) can carry project-scoped access restrictions. These restrictions are intended to limit which authenticated users may read or edit articles belonging to a given project.

The affected workflow — referred to in the NVD description as the "draft creation endpoint" (the exact URL path and request schema are not disclosed in the available data) — allows authenticated users to initialize draft articles before publication. During creation of a draft, the application resolves the article's target context (project membership and visibility). In affected versions, the authorization check that governs access to the referenced article or project context is missing or insufficiently enforced. The endpoint therefore trusts object references supplied in the request and returns the contents of articles that the requesting user is not entitled to read.

The vulnerability class is a Broken Object Level Authorization (BOLA / IDOR) pattern applied to a document-management workflow. The attacker does not need administrative privileges — the CVSS vector reflects PR:L (low privileges required) and AV:N (network-accessible). The absence of an authorization predicate on the server side means no authentication bypass occurs; rather, legitimate authentication is abused to reach objects outside the user's permitted scope. The confidentiality impact is High (C:H), while Integrity and Availability are unaffected (I:N/A:N), indicating the flaw is read-oriented and does not permit modification or deletion of articles.

No CNA title, no vendor advisory, and no patch source are available in the provided intelligence data. The precision of the technical analysis is therefore limited to the vulnerability class and attack mechanism. Specific function names, parameter names, and endpoint paths must not be inferred and are not stated in this report. Insufficient technical detail is available to describe the exact request structure or the precise authorization predicate that failed.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code has been identified for CVE-2026-75049. The attack chain below is inferred strictly from the NVD description and the vulnerability class (CWE-862 / BOLA). Attackers would require valid credentials for an account on the target YouTrack instance.

1. Reconnaissance / target identification. The attacker identifies an exposed YouTrack instance via Shodan or other internet-wide scanning (e.g., searching for server titles or product banners referencing "YouTrack"). The attacker then authenticates with a standard, low-privileged user account — such as an account created for a customer, contractor, or junior team member — that would not normally have access to articles in other projects. During reconnaissance, the attacker enumerates valid project/article identifiers visible in their own scope (team pages, linked issues, or published articles) and notes the identifier numbering scheme.

2. Triggering the flawed authorization check. The attacker issues a request to the draft creation endpoint while referencing an article identifier or project context outside their authorized scope. Because the endpoint evaluates the request without enforcing the project-scoped restriction (CWE-862), the server-side authorization predicate is never invoked. The request is processed as if the user were entitled to the target object. At the class level, this is an object-reference manipulation: the attacker substitutes a permitted identifier with a restricted one in the draft-creation workflow.

3. Payload / execution method. The execution does not rely on injection payloads or malformed input. The attack is a logic-abuse request: a query that instructs the server to create or render a draft of (or referencing) a restricted article. Because the endpoint is reachable over the network and requires only low privileges, the malicious request is a single HTTP call (or a small number of sequential calls) to the draft creation functionality. The response contains the restricted article's content, which the application renders back to the authenticated attacker.

4. Post-exploitation impact. The attacker collects the exfiltrated article content. Restricted articles in YouTrack frequently contain internal procedures, credentials in help-desk notes, design decisions, security documentation, and customer-specific data. The attacker can repeat the request across enumerated identifiers to harvest multiple restricted articles from any project on the instance, without triggering file-download or export events that might be more heavily monitored. The harvested data can be used for further targeted attacks, credential stuffing, or sold/leaked externally.

Impact Assessment

The CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N results in a base score of 6.5. The key characteristics are:

• Attack vector (Network): the vulnerable endpoint is reachable over the network; no local access is required.
• Privileges required (Low): only a standard authenticated account is needed; no administrator rights.
• Confidentiality (High): restricted articles from all projects can be read in full. The information disclosure is the sole impact.
• Integrity / Availability (None): the flaw does not allow modification or deletion of articles, nor denial of service.

Affected systems. Self-hosted and on-premise JetBrains YouTrack deployments running builds prior to 2026.1.13903 and prior to 2026.2.17950. JetBrains YouTrack is also offered as a hosted SaaS (YouTrack InCloud); the applied version on the hosted service is managed by JetBrains, and those instances may be patched independently of the customer's awareness.

Blast radius. The blast radius scales with the sensitivity of data stored in the instance's knowledge base. YouTrack is commonly used for issue tracking, help-desk articles, and internal documentation. Enterprises that store confidential project information, security policies, customer PII, or credential material in restricted articles face direct regulatory and reputational consequences. Because the vulnerability affects all authenticated users, the risk is not limited to external attackers — a disgruntled contractor or a lateral-moving internal adversary with any account can harvest data across the entire organization's project structure.

Exploitation in the wild. No CISA KEV listing, no vendor advisory, and no confirmed in-the-wild exploitation evidence is available in the provided data. EPSS has not yet scored this vulnerability; it should be treated as an actively watch-listed item given the simplicity of the attack class.

Detection Guidance

The exact endpoint path and request schema are undisclosed, so the detection rules below rely on the literal substring "draft" (derived from the NVD description's reference to the "draft creation endpoint") and on behavioral indicators such as high volumes of 200 OK responses against draft/article resources and identifier enumeration patterns. Tune thresholds to your environment's normal usage profile.

Sigma Rule

title: JetBrains YouTrack Draft Endpoint Access Anomaly - CVE-2026-75049
id: 7f3a0c91-2b8e-4c6a-9d12-5c9f8a3b1d44
status: experimental
description: Detects sustained or bulk access to the YouTrack draft creation endpoint,
  which may indicate attempted reading of restricted articles (CVE-2026-75049).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75049
author: Valters IT Threat Intelligence
date: 2026/05/14
logsource:
  category: webserver
  product: generic
  definition: Requires web server access logs covering the JetBrains YouTrack application
    and the source IP address / authenticated username.
detection:
  selection:
    cs-uri-path|contains: "draft"
    sc-status: "200"
  timeframe: 5m
  condition: selection | count() by c-ip > 30
fields:
  - c-ip
  - cs-username
  - cs-uri-path
  - sc-status
falsepositives:
  - Legitimate project administrators bulk-creating article drafts
  - Automated documentation workflows that create drafts programmatically
level: medium
tags:
  - attack.t1213
  - cve.2026.75049
  - cwe.862

YARA Rule

rule CVE_2026_75049_YouTrack_Draft_Article_Exfil
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects HTTP traffic or log payloads referencing YouTrack draft creation and article objects, consistent with CVE-2026-75049 exploitation"
        cve = "CVE-2026-75049"
        cwe = "CWE-862"
        date = "2026-05-14"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75049"
    strings:
        $s1 = "YouTrack" ascii nocase
        $s2 = "draft" ascii nocase
        $s3 = "article" ascii nocase
        $s4 = "restricted" ascii nocase
        $s5 = "project" ascii nocase
    condition:
        #s1 > 0 and #s2 > 0 and (#s3 > 0 or #s4 > 0 or #s5 > 0)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET WEB_SPECIFIC_APPS JetBrains YouTrack Draft Endpoint Enumeration Attempt (CVE-2026-75049)"; flow:established,to_server; http.uri; content:"draft"; nocase; http.method; content:"POST"; startswith; threshold: type both, track by_src, count 20, seconds 120; classtype:attempted-recon; sid:202675049; rev:1; metadata:created_at 2026_05_14, updated_at 2026_05_14, cve CVE-2026-75049;)

This rule flags a source IP that submits more than 20 requests containing "draft" in the URI to the YouTrack server within 120 seconds. Adjust the threshold to the baseline traffic of legitimate draft editing in your environment. Because the description does not disclose the exact path, the rule is intentionally broad and may require path refinement after a vendor advisory confirms the endpoint URL.

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.category == "web" and http.request.method == "POST" and url.path like "*draft*" ]
  [ network where event.category == "web" and http.response.status_code == 200 and destination.bytes > 50000 ]

The sequence correlates a POST to a draft-related URI with a subsequent high-volume 200 OK response to the same source, which is consistent with retrieving article content through the vulnerable endpoint. For hunt triage, a simpler aggregate view can be used:

network where event.category == "web" and url.path like "*draft*" and http.response.status_code == 200

Combine the EQL results with user-asset correlation: flag any authenticated user whose draft-endpoint 200 OK volume exceeds the 99th percentile for their role.

Splunk SPL Query

index=web sourcetype=access_combined uri_path="*draft*" status=200
| stats count, dc(uri_path) AS unique_draft_refs, values(uri_path) AS draft_uris, earliest(_time) AS first_seen, latest(_time) AS last_seen BY user, src_ip
| eval request_window = last_seen - first_seen
| where count >= 30 OR unique_draft_refs >= 10
| eval risk_score = (count * 5) + (unique_draft_refs * 10)
| sort - risk_score
| table _time, src_ip, user, count, unique_draft_refs, request_window, draft_uris, risk_score

This query surfaces authenticated users generating an anomalous number of 200 OK responses from draft-related URIs, which is the expected observable of an article-enumeration campaign. If authentication is not captured in the access log, pivot on src_ip.

Wazuh OSSEC Rule

<group name="web,">
  <rule id="100750" level="8" frequency="12" timeframe="300" ignore="60">
    <decoded_as>web</decoded_as>
    <match>draft</match>
    <regex> 200 </regex>
    <description>CVE-2026-75049: Possible JetBrains YouTrack restricted article enumeration via draft endpoint</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve-2026-75049,cwe-862,web_application_attack,</group>
  </rule>
</group>

The rule triggers when 12 web log events containing "draft" and HTTP status 200 are observed from the same source within 300 seconds. It relies on the Wazuh web decoder (Apache/nginx-style access logs). For environments where YouTrack is behind a reverse proxy, ensure the proxy logs (or the application's structured logs) are fed to Wazuh.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source; the vendor fix listing is empty and no official advisory has been confirmed. The NVD description implies that builds 2026.1.13903 and 2026.2.17950 contain the fix, but this has not been verified against a vendor source. Treat the vulnerability as actively exploitable until a formal upgrade is confirmed.

1. Immediate mitigations (no patch available yet):

   • Restrict network exposure of YouTrack to trusted networks via firewall/VPN. Do not expose the management interface or the application to the public internet unless business-critical; if exposure is required, place the instance behind a reverse proxy with mandatory multi-factor authentication.
   • Enforce least-privilege account provisioning. Audit all low-privileged accounts (contractors, support, cross-project collaborators) and disable dormant accounts.
   • If the draft creation feature can be disabled or limited to administrators via YouTrack's permission scheme, apply that restriction immediately.
   • Deploy a WAF rule that rate-limits requests to the draft creation endpoint and flags anomalous enumeration patterns (many distinct article identifiers per session).
   • Monitor logs with the detection rules above; on alert, disable the implicated account and review its access history.

2. Patch / upgrade steps:

   • Subscribe to JetBrains YouTrack security advisories (JetBrains issues-fixed page and product blog) to receive the official advisory.
   • As soon as JetBrains officially confirms the fixed builds, upgrade YouTrack to fetch 2026.1.13903 or 2026.2.17950 (or a later release), following the vendor's standard upgrade procedure and taking a full backup of the YouTrack database and configuration beforehand.
   • If the instance is YouTrack InCloud (hosted), confirm with JetBrains support that the hosted fleet has been updated to the fixed builds.

3. Long-term hardening:

   • Integrate Broken Object Level Authorization (BOLA/IDOR) testing into the application security program: automated DAST/SAST checks that verify authorization predicates on every object-access endpoint, including draft and preview workflows.
   • Establish a baseline and anomaly-detection threshold for knowledge-base article access per user role so future access-control regressions are caught behaviorally.
   • Review the YouTrack permission model quarterly: article visibility should default to "restricted" and be granted explicitly by project, not inherited globally.
   • Maintain a software inventory mapping each YouTrack instance (self-hosted and hosted) to its build number so the install base can be prioritized for patching when the official fix lands.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-75049
2. CWE-862 Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
3. MITRE ATT&CK T1213 Data from Information Repositories — https://attack.mitre.org/techniques/T1213/
4. JetBrains Security & Privacy (issues-fixed and advisories) — https://www.jetbrains.com/privacy-security/issues-fixed/
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-75049 is NOT listed at the time of writing)

No threat-actor campaigns, exploit-in-the-wild evidence, or public PoC are known for CVE-2026-75049 as of this report. EPSS has not yet scored this vulnerability; reassess when FIRST.org publishes a score.