Security readout for executives and security teams
Plain-English summary
A critical YouTrack flaw allows an unauthenticated attacker to download database backups by abusing a shared draft signature. Successful exploitation could expose sensitive YouTrack data without requiring an account or user interaction. Organizations running affected builds should treat upgrading as urgent, particularly where YouTrack is reachable from untrusted networks.
Executive priority
Prioritize remediation immediately. The vulnerability requires neither credentials nor user action and may expose complete database backups. Confirm ownership, affected versions, upgrade timing, and evidence review today. Internet-reachable or otherwise untrusted-network-accessible deployments should receive the highest operational priority.
Technical view
CVE-2026-75045 is an authentication-bypass issue classified as CWE-288. It affects YouTrack builds before 2025.3.156085, 2026.1.13913, and 2026.2.18112. The CVSS 3.1 score is 9.1, with network access, low complexity, no privileges, and no interaction required. The supplied description identifies database-backup download through a shared draft signature.
Likely exposure
YouTrack deployments on the listed release lines are potentially exposed when running builds below their respective fixed versions. Risk is greatest where attackers can reach the application. The supplied data does not identify affected hosting models, configurations, or prerequisites beyond the vulnerable version and shared draft signature mechanism.
Exploitation context
The source bundle does not report active exploitation, and the CVE is not marked as included in CISA KEV. This does not prove exploitation is absent. The network-accessible, unauthenticated, low-complexity characteristics make the vulnerability attractive, but no public proof of concept or observed campaign is established by the supplied sources.
Researcher notes
The published vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The description clearly supports unauthorized backup download and high confidentiality impact, but does not explain the asserted high integrity impact. Details about signature generation, scope, logging, hosting applicability, and exploit availability are absent, so those points should not be inferred.
Mitigation direction
- Upgrade each YouTrack deployment to its applicable fixed build or a later supported release.
- Follow JetBrains guidance for the supported upgrade path and any additional vendor mitigations.
- Restrict affected YouTrack access to trusted networks until upgrading is complete.
- Preserve relevant logs and investigate possible exposure before normal log retention removes evidence.
Validation and detection
- Inventory every YouTrack deployment and record its exact version and build number.
- Confirm each deployment meets or exceeds the fixed build for its release line.
- Review JetBrains security guidance for updated affected-version or remediation information.
- Review logs for unexpected backup downloads or suspicious shared draft signature activity.
- After upgrading, verify normal access works and unauthorized backup retrieval is no longer possible.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-288: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-75045 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2JetBrainsVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.jetbrains.com/privacy-security/issues-fixed/CVE reference, JetBrains
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.