Vulnerabilities

TI-2026-85842 CVE-2026-123300 · GHSA-4f3w-44wp-2963

JetBrains Hub lets read-only users change auth module group mappings

LOW 13

In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00272 Published 2026-11-06 Fixed in 2026.2.52519 CWE-862

TI-2026-85841 CVE-2026-123299 · GHSA-97pc-f7hr-wf22

LOW 15

In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00216 Published 2026-11-06 Fixed in 2026.2.52519 CWE-863

TI-2026-85839 CVE-2026-123297 · GHSA-9v9m-pfrr-mhw5

LOW 32

In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00335 Published 2026-11-06 Fixed in 2026.2.52519 CWE-304

TI-2026-85838 CVE-2026-123296 · GHSA-vrf4-266q-776w

LOW 35

In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0032 Published 2026-11-06 Fixed in 2026.2.52519 CWE-863

TI-2026-85837 CVE-2026-123295 · GHSA-hmgg-g8gj-f7wg

LOW 37

In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00385 Published 2026-11-06 Fixed in 2026.2.52519 CWE-863