CVE-2026-75051: 
YouTrack vulnerability analysis and mitigation

CVE-2026-75051 is an authorization bypass vulnerability in JetBrains YouTrack that allows authenticated low-privileged users to perform unauthorized project transfers between organizations. Affecting all YouTrack versions before 2026.2.17917, the flaw was disclosed and patched on August 17, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, JetBrains).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the application fails to perform an authorization check when a user attempts to execute a project transfer operation between organizations. An authenticated attacker with low-level privileges can invoke the project transfer functionality without the system verifying whether they hold the necessary organizational permissions to do so. The attack is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit for any authenticated user (GitHub Advisory).

Successful exploitation allows a low-privileged authenticated user to move projects from one organization to another without authorization, exposing sensitive project data — including issues, code, and associated metadata — to unintended organizational contexts. This results in high confidentiality and integrity impact, as project data may be accessed by unauthorized parties and project ownership is altered without consent. Availability is not directly affected, but the unauthorized transfer could disrupt workflows and organizational data governance (GitHub Advisory).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD SSVC assessment notes the attack is not automatable, though technical impact is rated as total.

1. Authentication: Log in to a JetBrains YouTrack instance (version before 2026.2.17917) with any valid low-privileged user account that has access to at least one project.
2. Identify target project: Enumerate accessible projects within the YouTrack instance to identify a project to transfer.
3. Invoke transfer endpoint: Send a crafted API or UI request to the project transfer functionality, specifying a target organization different from the project's current owner — bypassing the missing authorization check.
4. Confirm unauthorized transfer: Verify that the project now appears under the target organization, granting that organization's members access to the project's data without legitimate authorization (GitHub Advisory).

• Logs: YouTrack audit logs showing project transfer events initiated by users who do not hold administrative or organization-owner roles; unexpected changes in project organizational assignment timestamps.
• Application Activity: Projects appearing under organizations to which they were not originally assigned; user accounts with low privilege levels appearing as initiators of organization-level transfer actions.
• Network: Unusual API calls to YouTrack project management endpoints (e.g., project transfer or organization assignment APIs) from non-administrative user sessions.

JetBrains has released a fix in YouTrack version 2026.2.17917. All users should upgrade to this version or later immediately. As a post-incident measure, administrators should review project ownership and organizational assignments to identify any unauthorized transfers that may have occurred prior to patching, and enable audit logging for project transfer operations to detect future anomalies (JetBrains, GitHub Advisory).

The vulnerability received standard automated coverage across CVE tracking platforms and security feeds shortly after disclosure on August 17, 2026, with mentions on Bluesky CVE tracking accounts and aggregator sites. No notable independent researcher commentary or significant media coverage has been identified beyond routine vulnerability database entries.