Is CVE-2026-56142 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56142 being exploited in the wild.

How severe is CVE-2026-56142?

Critical severity, with a CVSS score of 9.9, published 19 June 2026.

Which products and versions are affected?

Jetbrains Hub Before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429.

Is there a fix for CVE-2026-56142?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56142 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-56142?

Check whether you run Jetbrains Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56142: JetBrains Hub privilege escalation via authentication detail attachment

CVE-2026-56142 · Severity: critical · CVSS 9.9 · Published 2026-06-19

JetBrains Hub, a central authentication and authorization service for JetBrains team tools, contains a vulnerability that allows users to escalate their privileges. By improperly attaching authentication details to accounts, an attacker could gain unauthorized access to administrative functions or other users' data. This could lead to a full compromise of the identity management system and the integrated tools it supports.

Technologies: Jetbrains Hub. Vendors: Jetbrains.

Quick answers

Is CVE-2026-56142 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56142 being exploited in the wild.
How severe is CVE-2026-56142?: Critical severity, with a CVSS score of 9.9, published 19 June 2026.
Which products and versions are affected?: Jetbrains Hub Before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429.
Is there a fix for CVE-2026-56142?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56142 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-56142?: Check whether you run Jetbrains Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in JetBrains Hub due to improper control of dynamically-determined object attributes (CWE-915). An authenticated attacker with low-level permissions can exploit this by attaching specific authentication details to accounts, effectively bypassing intended access controls. The vulnerability is reachable over the network and has a high impact on confidentiality, integrity, and availability across the security scope. JetBrains has released several patched versions across different release branches to address this issue.

Affected products

JetBrains Hub Before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429

Timeline

2026-06-19: disclosed
2026-06-19: advisory

References

https://www.jetbrains.com/privacy-security/issues-fixed/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.