CVE-2026-75046: 
YouTrack vulnerability analysis and mitigation

CVE-2026-75046 is an account enumeration vulnerability in JetBrains YouTrack that allows authenticated users to discover valid user accounts via the users search endpoint. It affects all YouTrack versions before 2026.2.18112 and was disclosed on August 17, 2026. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium), assigned by JetBrains (GitHub Advisory, JetBrains).

The root cause is a missing authorization check (CWE-862) on the users search endpoint in JetBrains YouTrack. An authenticated user with low privileges can query this endpoint to enumerate valid accounts, receiving responses that reveal the existence and details of user accounts in the system. Exploitation requires only a valid authenticated session and network access to the YouTrack instance — no elevated privileges or user interaction are needed (GitHub Advisory, JetBrains).

Successful exploitation allows a low-privileged authenticated attacker to enumerate valid user accounts within the YouTrack instance, disclosing account existence and associated details. This is a confidentiality-only impact with no effect on integrity or availability. The exposed account information could facilitate targeted phishing, credential stuffing, or further privilege escalation attempts against identified accounts (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation is not automatable per NVD SSVC assessment, as it requires an authenticated session (GitHub Advisory).

1. Obtain authentication: Log in to the target JetBrains YouTrack instance with any valid low-privileged user account.
2. Identify the users search endpoint: Locate the API endpoint used for user search (e.g., /api/users or similar YouTrack REST API path).
3. Send enumeration queries: Issue HTTP GET or POST requests to the users search endpoint with varying usernames, email prefixes, or search terms.
4. Analyze responses: Observe differences in API responses (e.g., returned user objects, counts, or error messages) to determine which accounts exist in the system.
5. Compile account list: Aggregate valid usernames or email addresses for use in downstream attacks such as phishing or credential stuffing (GitHub Advisory).

• Network: Unusual volume of requests to the YouTrack users search API endpoint (e.g., /api/users) from a single authenticated session, particularly with iterative or pattern-based query parameters.
• Logs: YouTrack access logs showing repeated search queries with sequential or dictionary-based usernames/email patterns from a single user account in a short time window.
• Behavior: A low-privileged user account generating an abnormally high number of user search API calls compared to normal usage baselines.

Upgrade JetBrains YouTrack to version 2026.2.18112 or later, which contains the fix for this vulnerability. As a temporary workaround prior to patching, consider restricting access to the users search endpoint for low-privileged authenticated users through network-level controls or application firewall rules. Monitor the users search endpoint for anomalous query patterns as a compensating control (JetBrains, GitHub Advisory).