Vulnerabilities

TI-2026-64607 CVE-2026-100266 · GHSA-f59m-626g-488f

Missing authorization in JetBrains Hub

LOW 33

In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00228 Published 2026-09-30 Fixed in 2026.2.52366 CWE-862

TI-2026-36991 CVE-2026-50242 · GHSA-xqpc-xqhc-3crx

Missing authentication in JetBrains Hub

MEDIUM 50

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00611 Published 2026-06-19 Fixed in 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 CWE-306

TI-2026-40518 CVE-2026-56142 · GHSA-v6fr-2xp3-xpr7

Mass assignment in JetBrains Hub

MEDIUM 44

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00623 Published 2026-06-19 Fixed in 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 CWE-915

TI-2026-40517 CVE-2026-56141 · GHSA-cq2r-w6jr-x35w

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120…

MEDIUM 49

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00522 Published 2026-06-19 Fixed in 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 CWE-338

TI-2026-24759 CVE-2026-32229 · GHSA-rjrm-hghf-rqww

In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled

LOW 31

In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00198 Published 2026-03-11 Fixed in 2025.3.128064 CWE-290

TI-2026-20894 CVE-2026-25848 · GHSA-m7gw-jxv4-qv8m

In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible

MEDIUM 49

In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00465 Published 2026-02-09 Fixed in 2025.3.119807 CWE-306

TI-2025-40038 CVE-2025-64683 · GHSA-f747-w67p-qmf9

In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API

LOW 38

In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00217 Published 2025-11-10 Fixed in 2025.3.104432 CWE-362

TI-2025-40037 CVE-2025-64682 · GHSA-2jff-6cp9-g4pm

In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit

LOW 17

In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00167 Published 2025-11-10 Fixed in 2025.3.104432 CWE-362

TI-2025-40036 CVE-2025-64681 · GHSA-39mm-cqh8-5c5j

In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations

LOW 17

In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.002 Published 2025-11-10 Fixed in 2025.3.104992 CWE-862

TI-2025-18189 CVE-2025-24456 · GHSA-m643-p29m-frx3

In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping

MEDIUM 40

In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00295 Published 2025-01-21 Fixed in 2024.3.55417 CWE-288

TI-2024-34002 CVE-2024-50573 · GHSA-xrq3-qh6q-h4xq

Missing authorization in JetBrains Hub

LOW 24

In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00221 Published 2024-10-28 Fixed in 2024.3.47707 CWE-862

TI-2024-25743 CVE-2024-38507 · GHSA-g868-j635-p59m

In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible

LOW 24

In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00238 Published 2024-06-18 Fixed in 2024.2.34646 CWE-79

TI-2022-24057 CVE-2022-48477 · GHSA-747c-jg37-7m9c

In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing

MEDIUM 43

In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00482 Published 2023-04-24 Fixed in 2023.1.15725 CWE-918

TI-2022-24014 CVE-2022-48429 · GHSA-xxmr-593v-8f45

In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible

LOW 25

In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00603 Published 2023-03-27 Fixed in 2022.3.15573, 2022.2.15572 +1 CWE-79

TI-2022-22429 CVE-2022-45471 · GHSA-hq4m-5hfj-8xjc

In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address

LOW 34

In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00563 Published 2022-11-18 Fixed in 2022.3.15181 CWE-770

TI-2022-15690 CVE-2022-34894 · GHSA-c73c-584x-2rjh

In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services

LOW 25

In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00607 Published 2022-07-01 Fixed in 2022.2.14799 CWE-284

TI-2022-12171 CVE-2022-29811 · GHSA-g5m9-8h5w-cxvx

In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.

LOW 28

In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00485 Published 2022-04-28 Fixed in 2022.1.14638 CWE-79

TI-2022-08965 CVE-2022-25259 · GHSA-7c6v-jqv8-rjmr

JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS.

LOW 28

JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00568 Published 2022-02-25 No fix listed CWE-79

TI-2022-08966 CVE-2022-25260 · GHSA-m37j-2vr4-qq8w

JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF).

MEDIUM 44

JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02391 Published 2022-02-25 No fix listed CWE-918

TI-2022-08968 CVE-2022-25262 · GHSA-3fcg-56fr-gpww

In JetBrains Hub before 2022.1.14434, SAML request takeover was possible.

MEDIUM 45

In JetBrains Hub before 2022.1.14434, SAML request takeover was possible.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01452 Published 2022-02-25 No fix listed CWE-345

TI-2022-08206 CVE-2022-24328 · GHSA-hh4r-8h4c-83j4

In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS.

LOW 30

In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00819 Published 2022-02-25 No fix listed

TI-2022-08205 CVE-2022-24327 · GHSA-cm93-88xh-rg58

In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions.

LOW 35

In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00913 Published 2022-02-25 No fix listed CWE-732

TI-2021-19192 CVE-2021-43180 · GHSA-pmv7-fx9m-r47p

In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible.

LOW 35

In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01003 Published 2021-11-09 No fix listed

TI-2021-19194 CVE-2021-43182 · GHSA-3q6c-xv98-jf35

In JetBrains Hub before 2021.1.13415, a DoS via user information is possible.

LOW 35

In JetBrains Hub before 2021.1.13415, a DoS via user information is possible.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00961 Published 2021-11-09 No fix listed

TI-2021-19193 CVE-2021-43181 · GHSA-6jvj-ph6w-3cp6

In JetBrains Hub before 2021.1.13690, stored XSS is possible.

LOW 28

In JetBrains Hub before 2021.1.13690, stored XSS is possible.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00581 Published 2021-11-09 No fix listed CWE-79

Vulnerabilities

Filters