# CVE-2026-103496: JetBrains YouTrack insecure direct object reference in inbox threads

Source: https://junglewise.ai/threats/cve-2026-103496-in-jetbrains-youtrack-before-2026-2-19422-idor-in-inbox-threads  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-103496 · Severity: medium · CVSS 5.4 · Published 2026-10-01

JetBrains YouTrack is a project management and issue tracking system used by development teams. An insecure direct object reference (IDOR) vulnerability in the inbox threads feature allowed attackers to read other users' notifications without authorization. This could expose sensitive project information and internal communications visible only to specific team members.

Technologies: [Jetbrains YouTrack](https://junglewise.ai/threats/technologies/youtrack). Vendors: [Jetbrains](https://junglewise.ai/threats/vendors/jetbrains).

## Quick answers

**Is CVE-2026-103496 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103496 being exploited in the wild.

**How severe is CVE-2026-103496?** Medium severity, with a CVSS score of 5.4, published 1 October 2026.

**Which products and versions are affected?** Jetbrains YouTrack before 2026.2.19422.

**Is there a fix for CVE-2026-103496?** Yes: fixed in YouTrack 2026.2.19422. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103496 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103496?** Check whether you run Jetbrains YouTrack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in YouTrack 2026.2.19422

## Technical details

An IDOR vulnerability in YouTrack's inbox threads endpoint allows attackers to access notifications belonging to other users by manipulating object identifiers in API requests. The vulnerability requires network access and does not require authentication or special privileges. An attacker can enumerate and retrieve any user's notifications, exposing potentially sensitive project data and internal discussions.

## Affected products

- JetBrains YouTrack before 2026.2.19422

## Timeline

- 2026-10-01: disclosed

## References

- [https://www.jetbrains.com/privacy-security/issues-fixed/](https://www.jetbrains.com/privacy-security/issues-fixed/)

## Related threats

- [JetBrains YouTrack missing authorization in VCS hosting configuration](https://junglewise.ai/threats/cve-2026-123332-in-jetbrains-youtrack-before-2026-2-19562-missing-authorization)
- [JetBrains YouTrack article visibility restriction bypass](https://junglewise.ai/threats/cve-2026-123331-in-jetbrains-youtrack-before-2026-2-19197-article-editors-could)
- [JetBrains YouTrack missing authorization in issue visibility settings](https://junglewise.ai/threats/cve-2026-123330-in-jetbrains-youtrack-before-2026-2-19562-missing-authorization)
- [JetBrains YouTrack missing authorization in TeamCity integration](https://junglewise.ai/threats/cve-2026-123329-in-jetbrains-youtrack-before-2026-2-19562-missing-authorization)
- [JetBrains YouTrack app permission bypass privilege escalation](https://junglewise.ai/threats/cve-2026-123328-in-jetbrains-youtrack-before-2026-2-19656-app-permission-bypass)