CVE-2026-25846

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25846", "assignerOrgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "state": "PUBLISHED", "assignerShortName": "JetBrains", "dateReserved": "2026-02-06T14:16:36.496Z", "datePublished": "2026-02-09T10:38:59.786Z", "dateUpdated": "2026-02-09T13:46:19.192Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "shortName": "JetBrains", "dateUpdated": "2026-02-09T10:38:59.786Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-532", "cweId": "CWE-532"}]}], "affected": [{"vendor": "JetBrains", "product": "YouTrack", "versions": [{"version": "0", "status": "affected", "lessThan": "2025.3.119033", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs"}], "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T13:45:33.033939Z", "id": "CVE-2026-25846", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T13:46:19.192Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25846", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T13:45:33.033939Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T13:45:39.480Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "JetBrains", "product": "YouTrack", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.3.119033", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/"}], "descriptions": [{"lang": "en", "value": "In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-532", "description": "CWE-532"}]}], "providerMetadata": {"orgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "shortName": "JetBrains", "dateUpdated": "2026-02-09T10:38:59.786Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25846", "state": "PUBLISHED", "dateUpdated": "2026-02-09T13:46:19.192Z", "dateReserved": "2026-02-06T14:16:36.496Z", "assignerOrgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "datePublished": "2026-02-09T10:38:59.786Z", "assignerShortName": "JetBrains"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "YouTrack", "vendor": "JetBrains", "versions": [{"lessThan": "2025.3.119033", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cve@jetbrains.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*", "matchCriteriaId": "CC1847FB-B46E-4DF2-9466-8C942DB90519", "versionEndExcluding": "2025.3.119033", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs"}, {"lang": "es", "value": "En JetBrains YouTrack antes de 2025.3.119033 los tokens de acceso podr\u00edan ser expuestos en los registros del buz\u00f3n."}], "id": "CVE-2026-25846", "lastModified": "2026-06-17T10:25:19.050", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "cve@jetbrains.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25846", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T13:45:33.033939Z", "version": "2.0.3"}}]}, "published": "2026-02-09T11:16:14.787", "references": [{"source": "cve@jetbrains.com", "tags": ["Vendor Advisory"], "url": "https://www.jetbrains.com/privacy-security/issues-fixed/"}], "sourceIdentifier": "cve@jetbrains.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "cve@jetbrains.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2025.3.119033)"}}], "product": "youtrack", "vendor": "jetbrains"}], "analysis": {"en": {"generated_at": "2026-04-17T21:28:27.056709+00:00", "value": {"mitigation_remediation": ["Upgrade YouTrack to version 2025.3.119033 or newer to eliminate the insecure logging behavior.", "Immediately rotate or regenerate existing access tokens and enforce least privilege for token usage.", "Implement log sanitization or review log configuration to ensure no sensitive data is recorded; consider disabling detailed mailbox logging until verified secure.", "Monitor log files for unexpected token entries and review access controls on log repositories."], "summary": {"action": "Update", "impact": "Confidentiality compromise via exposed access tokens"}, "threat_synthesis": {"affected_systems": "Affected vendors and products include JetBrains YouTrack. Any installation of YouTrack earlier than version 2025.3.119033 is vulnerable. The specific version boundary is provided by the description: before 2025.3.119033. No other product or vendor listings are noted.", "description_and_impact": "In JetBrains YouTrack versions prior to 2025.3.119033, the system writes access tokens to mailbox logs without sanitization, allowing potential extraction of tokens. An attacker who can read these logs could obtain credentials that provide full access to the YouTrack instance, compromising confidentiality and potentially enabling further actions such as data exfiltration or unauthorized modifications. The weakness aligns with CWE-532, which describes insecure log handling.", "risk_and_exploitability": "The CVSS base score of 6.5 reflects a moderate severity with potential impact on confidentiality. EPSS indicates a low likelihood of exploitation (<1%). The vulnerability is not yet listed in CISA's KEV catalog, suggesting it is not a widely exploited or known, targeted threat. Likely attack vectors involve reading mailbox logs, which may be accessible to authenticated users or system administrators, so the risk is higher for organizations with broad log access permissions."}}}}, "created": "2026-02-10T12:23:43.042429+00:00", "title": "YouTrack Access Tokens Exposed in Mailbox Logs", "updated": "2026-04-17T21:30:28.394108+00:00", "vendors": ["jetbrains", "jetbrains$PRODUCT$youtrack"]}