# CVE-2026-86478: JetBrains YouTrack Helpdesk unauthenticated account takeover via improper email authentication

Source: https://junglewise.ai/threats/cve-2026-86478-jetbrains-youtrack-helpdesk-unauthenticated-account-takeover-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86478 · Severity: critical · CVSS 9.8 · Published 2026-09-07

JetBrains YouTrack Helpdesk is a customer support platform used by organizations to manage service requests and customer interactions. A flaw in its authentication mechanism allowed attackers to take over user accounts by self-asserting an email address without proper verification, enabling unauthorized access to customer data and support systems without requiring valid credentials.

Vendors: [Jetbrains](https://junglewise.ai/threats/vendors/jetbrains).

## Quick answers

**Is CVE-2026-86478 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86478 being exploited in the wild.

**How severe is CVE-2026-86478?** Critical severity, with a CVSS score of 9.8, published 7 September 2026.

**Which products and versions are affected?** Jetbrains YouTrack Helpdesk before 2025.3.161254, before 2026.1.14042.

**Is there a fix for CVE-2026-86478?** A patch was published on 2026-01-14: Fixed in version 2026.1.14042 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86478 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-86478?** Check whether you run Jetbrains YouTrack Helpdesk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in YouTrack Helpdesk's authentication logic, where improper validation of email-based identity allowed attackers to claim and register arbitrary email addresses without verification. The flaw enables unauthenticated account takeover through self-asserted email identity, meaning no prior authentication or valid credentials are required—an attacker can directly register or take over an account associated with any email address. The attack is network-accessible and requires no special preconditions beyond network reachability. This allows full account compromise and access to customer support data, tickets, and potentially sensitive organizational information. The vulnerability was fixed in versions 2025.3.161254 and 2026.1.14042.

## Affected products

- JetBrains YouTrack Helpdesk before 2025.3.161254, before 2026.1.14042

## Timeline

- 2026-09-07: disclosed
- 2026-01-14: patched: Fixed in version 2026.1.14042
- 2025-03-16: patched: Fixed in version 2025.3.161254

## References

- [https://www.jetbrains.com/privacy-security/issues-fixed/](https://www.jetbrains.com/privacy-security/issues-fixed/)