CVE-2026-75051

Executive Summary

CVE-2026-75051 is a missing authorization vulnerability in JetBrains YouTrack, the company's web-based issue tracking and project management platform. In all builds prior to 2026.2.17917, an authenticated user with a low-privileged account can transfer a project between organizations without the required authorization, breaking the tenant-isolation model of the product. The vulnerability carries a CVSS 8.1 (High) score with high confidentiality and integrity impact, and it affects both self-hosted and managed YouTrack deployments running vulnerable builds. No public proof-of-concept or in-the-wild exploitation has been reported at this time, and no patch evidence is currently available from the tracked sources.

Technical Analysis

The root cause of CVE-2026-75051 is a missing authorization check (CWE-862) in the project transfer workflow of JetBrains YouTrack. The NVD description states: "In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible." This is a classic broken access control flaw: the application fails to verify that the authenticated actor holds sufficient rights (e.g., project admin or organization admin role) before executing a cross-organization transfer operation.

YouTrack models projects, teams, and organizations as separate tenancy boundaries. A project transfer is an administrative operation that should be restricted to users with appropriate roles in both the source and the destination organization. In vulnerable builds, the server-side authorization logic that should gate this operation is either absent or incorrectly implemented, allowing any authenticated user to issue a transfer request.

Attack surface and mechanism:

• Authentication requirement: The attacker must be an authenticated user of the target YouTrack instance (CVSS vector indicates PR:L — low privileges required). Unauthenticated exploitation is not indicated.
• Network exposure: The vulnerability is reachable over the network (AV:N). YouTrack is commonly deployed as an internet-facing service or an internal tool accessible across a corporate network.
• Flaw class: Missing authorization (CWE-862). The affected component is the server-side API/business-logic layer handling organization and project administration. No SQL injection, memory corruption, or deserialization is implied by the available data.
• Confidentiality and integrity impact: A successful unauthorized transfer relocates a project — including its issue tracker, boards, attachments, workflows, and associated metadata — into an attacker-selected organization. This exposes the project's contents to members of the destination organization (confidentiality) and alters the project's ownership, potentially allowing the attacker to control or delete the project (integrity).

Insufficient technical detail is available from the NVD description to name the exact endpoints, parameters, or handler functions involved. The following analysis is therefore based on the vulnerability class and the product's documented feature set, without fabricating implementation-specific identifiers. Additional technical detail is expected to arrive with a future vendor advisory.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-862, missing authorization) and the NVD description. Steps are described at the class level.

1. Reconnaissance / target identification: The attacker identifies a vulnerable YouTrack instance via Shodan queries such as http.title:"YouTrack" or by fingerprinting the login page and build number. The build number can be obtained from the About page or the server response headers. Builds below 2026.2.17917 are potentially vulnerable. The attacker enumerates existing organizations and projects accessible from their account to identify a target project to transfer.

2. Triggering the flaw: Using their low-privileged authenticated session, the attacker invokes the project transfer functionality that is exposed in the web UI or the underlying REST API. The application processes the request without enforcing the required role-based authorization check. Because no authorization guard exists in the server-side logic, the transfer is accepted regardless of the attacker's role.

3. Execution / payload: The attack requires no malicious payload in the traditional sense — no injection, no shellcode, no file upload. The "payload" is a crafted HTTP request containing the source project identifier and the destination organization identifier. The server-side handler commits the ownership change because it never validates that the requesting user holds the project-admin or organization-admin privilege.

4. Post-exploitation impact: Once the transfer succeeds, the project and all of its contents (issues, comments, attachments, custom fields, and workflow scripts) are visible to users of the destination organization. The attacker gains effective oversight over the project data and may continue to rename, restructure, or delete the project depending on the permissions granted to them in the destination organization. The legitimate owners of the source organization lose administrative control over the project, resulting in a sustained availability and integrity impact from the business perspective (though the CVSS vector itself lists A:N). In a multi-tenant or managed environment, this breaks the isolation between customer organizations.

Impact Assessment

• CVSS context (8.1, High — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N): The vector shows the attack is network-reachable, requires no user interaction, and demands only low privileges (a standard authenticated account). High confidentiality and high integrity impact reflect that an attacker can both exfiltrate the project's confidential contents and alter its ownership/integrity. Availability impact is listed as none because the transfer itself does not necessarily delete the project.
• Business impact: Project data in YouTrack typically contains tickets, internal communication, code review references, sprint planning, and attached documents. Unauthorized transfer to an attacker-controlled organization can result in: (1) leakage of proprietary business data to unauthorized parties; (2) loss of control over projects, blocking normal development workflows; (3) tampering with issue metadata and workflows, undermining audit trails; and (4) in managed/multi-tenant deployments, contractual and regulatory violations related to customer data segregation.
• Affected systems: All YouTrack instances running builds before 2026.2.17917. The NVD record does not list explicit affected versions, but the description unambiguously bounds the vulnerable range as < 2026.2.17917. Both on-premises installations and JetBrains-managed YouTrack instances are in scope. Ambiguous product vendor metadata (recorded as "Unknown / Unknown") does not change the identification: the affected product is JetBrains YouTrack.
• Blast radius: Any authenticated user of the instance, regardless of role, can be the attacker. Because the flaw requires only low privileges, the population of potential attackers is large in any organization with many staff accounts, contractors, or externally shared accounts. In cloud/multi-tenant YouTrack offerings, the blast radius can extend across arbitrary organizations within the same service.

Detection Guidance

The following detection content is provided as a starting point. Because no exploit-specific indicators exist, detections focus on anomalous project-transfer activity, authorization failures preceding successful transfers, and references to the CVE. Field names in the rules are examples and must be adapted to the local logging schema.

Sigma Rule

title: JetBrains YouTrack Unauthorized Project Transfer Attempt (CVE-2026-75051)
id: 8a2b3c4d-1234-5678-9abc-def012345678
status: experimental
description: Detects a project transfer operation in JetBrains YouTrack performed by a low-privileged or non-admin account, potentially indicating exploitation of CVE-2026-75051.
logsource:
  category: application
  product: youtrack
detection:
  selection_transfer:
    event.action: project.transfer
  selection_privilege:
    user.role:
      - 'user'
      - 'reporter'
      - 'developer'
  selection_status:
    response.status:
      - '200'
      - '201'
      - '202'
  condition: selection_transfer and selection_privilege and selection_status
  timeframe: 5m
falsepositives:
  - Legitimate administrators who are misclassified in the identity feed
  - Service accounts with inherited project-admin roles
level: high

YARA Rule

rule CVE_2026_75051_YouTrack_Transfer_Exploit
{
    meta:
        author = "ValtersIT SOC"
        description = "Detects scripts or web shells referencing CVE-2026-75051 / YouTrack unauthorized project transfer"
        date = "2026-02-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75051"
    strings:
        $cve = "CVE-2026-75051" ascii wide nocase
        $ref1 = "youtrack" ascii wide nocase
        $ref2 = "project transfer" ascii wide nocase
        $ref3 = "unauthorised project" ascii wide nocase
        $ref4 = "2026.2.17917" ascii wide
        $ref5 = "organi" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and $cve and 2 of ($ref*)
        or $cve and 3 of ($ref*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET WEB_SPECIFIC_APPS JetBrains YouTrack Unauthorized Project Transfer Attempt (CVE-2026-75051)"; flow:established,to_server; http.user_agent; content:"youtrack", nocase; http.request; content:!,"GET", http.method; content:"transfer", http.request, nocase; http.response; content:"200", http.response_code; metadata:created_at 2026-01-15, updated_at 2026-01-15; reference:cve,2026-75051; classtype:attempted-user; sid:7505100001; rev:1;)

Elastic Detection

EQL query against Elasticsearch web/application logs:

any where event.module == "youTrack" or process.name == "youtrack"
  and event.action == "project.transfer"
  and user.role in ("user", "reporter", "guest")
  and http.response.status_code in (200, 201, 202)

Splunk SPL Query

index=youTrack OR index=web sourcetype="youtrack:access" OR sourcetype="youtrack:audit"
| rename actor.role as role, action as action, http_status as status
| search action="project.transfer" role IN ("user","reporter","developer","guest")
| where status >= 200 AND status < 300
| stats count min(_time) as first_seen max(_time) as last_seen
    by src_ip, actor, target_organization, source_organization, status
| where count >= 1
| sort - last_seen
| table _time, src_ip, actor, source_organization, target_organization, count

Wazuh OSSEC Rule

<group name="youtrack,">
  <rule id="750511" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">project.transfer</field>
    <field name="role" type="pcre2">(user|reporter|developer|guest)$</field>
    <field name="status" type="pcre2">^(200|201|202)$</field>
    <description>JetBrains YouTrack: possible unauthorized project transfer by low-privileged user (CVE-2026-75051)</description>
    <group>cve-2026-75051,access_control,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED — with no patch evidence from any tracked source. The NVD description indicates that the fixed build is 2026.2.17917, but no vendor advisory or patch confirmation has been observed in the tracked sources at this time.

1. Immediate mitigations (pre-patch):

   • Restrict network access to the YouTrack web UI and API to trusted networks and users only. Do not expose the instance directly to the internet unless necessary.
   • Review and revoke unnecessary user accounts, especially contractor or shared accounts, to reduce the population of low-privileged authenticated users.
   • Enable and enforce multi-factor authentication (MFA) for all YouTrack accounts.
   • If your deployment supports it, disable or restrict the project transfer feature via permission scheme configuration until the fix is applied.
   • Monitor audit logs for project transfer events and alert on any transfer performed by non-admin roles.

2. Patch / upgrade steps:

   • Upgrade JetBrains YouTrack to build 2026.2.17917 or later as soon as a vendor release is available. The NVD description explicitly identifies 2026.2.17917 as the version in which the vulnerability is fixed.
   • Verify the build number on the server administration page before and after upgrade. Confirm against JetBrains' official YouTrack release notes and security bulletins, and subscribe to JetBrains' security advisory mailing list for confirmation of the patch.

3. Long-term hardening:

   • Apply the principle of least privilege: review all role assignments and ensure that only project and organization admins can perform organizational operations.
   • Implement a change-management/audit process for cross-organization actions and require re-authentication for sensitive operations such as project transfer.
   • Keep YouTrack and all JetBrains components updated on a regular cadence. Treat the highly network-exposed nature of issue trackers as a critical-risk asset class.
   • Consider integrating YouTrack audit logs into the central SIEM for continuous monitoring of authorization failures and transfer operations.

References

1. NVD — CVE-2026-75051: https://nvd.nist.gov/vuln/detail/CVE-2026-75051
2. JetBrains YouTrack official product page and release notes: https://www.jetbrains.com/youtrack/ (check for build 2026.2.17917 notes)
3. MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat-actor activity and exploit-in-the-wild evidence: None reported. CISA KEV status is NO; no known ransomware or APT campaigns involving CVE-2026-75051 have been identified as of the date of this report. PoC/exploit status is UNKNOWN with no exploit code or Nuclei template available. Organizations should nevertheless treat this as a high-priority unpatched authorization flaw and apply compensating controls immediately.