In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120…
Priority MEDIUM 49CWE-338Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00522 44th percentileScored 2026-11-07
Fix Fixed Hub (JetBrains): 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| JetBrains | Hub | before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 | 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 | Patch available | CNA |
- Hub VendorJetBrains Affected before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 Fixed in 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jetbrains:hub:*:*:*:*:*:*:*:* | 2024.2.33606 to before 2024.2.148429; 2024.3.44799 to before 2024.3.148430; 2025.1.62455 to before 2025.1.148120; 2025.2.86069 to before 2025.2.148048; 2025.3.104432 to before 2025.3.148033; 2026.1.12024 to before 2026.1.13757 | Vulnerable | JetBrains |
- cpe:2.3:a:jetbrains:hub:*:*:*:*:*:*:*:* Versions 2024.2.33606 to before 2024.2.148429; 2024.3.44799 to before 2024.3.148430; 2025.1.62455 to before 2025.1.148120; 2025.2.86069 to before 2025.2.148048; 2025.3.104432 to before 2025.3.148033; 2026.1.12024 to before 2026.1.13757 Vulnerable ·JetBrains
Remediation
- Fix · CNA Hub (JetBrains) Fixed in 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
JetBrains Hub 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2026-36991 Missing authentication in JetBrains HubPriority MEDIUM 50
- TI-2026-40518 Mass assignment in JetBrains HubPriority MEDIUM 44
Timeline
- 2026-10-02 Threatist record created from CVE-2026-56141
- 2026-10-03 Alias added: GHSA-cq2r-w6jr-x35w
References
More JetBrains Hub vulnerabilities
- TI-2026-36991 Missing authentication in JetBrains Hub CVSS 3.1CRITICAL 10.0
- TI-2026-20894 In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible CVSS 3.1CRITICAL 9.8
- TI-2022-08968 In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. CVSS 3.1CRITICAL 9.8
- TI-2026-40518 Mass assignment in JetBrains Hub CVSS 3.1CRITICAL 9.6
- TI-2022-08966 JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). CVSS 3.1CRITICAL 9.1
- TI-2021-19195 In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-56141 · CVE Program
- CVE-2026-56141 · NVD
- FIRST EPSS
- GHSA-cq2r-w6jr-x35w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences