{"id":"CVE-2026-123294","published":"2026-11-06T11:17:08.140","lastModified":"2026-11-07T05:18:12.623","description":"In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-915"],"vendors":[],"products":[],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"In JetBrains Hub before version 2026.2.52556, a privilege escalation vulnerability (CWE-915) allowed authenticated low-privilege users to modify their email authentication details during the verification flow, potentially gaining elevated privileges without proper authorization.","exploitability":"Exploitation requires valid low-privilege user credentials and no user interaction, as the flaw exists in the server-side verification logic during email update.","blast_radius":"Successful exploitation could allow attackers to escalate privileges within JetBrains Hub, compromising confidentiality and integrity of project data, but availability is unaffected.","remediation":"Upgrade JetBrains Hub to version 2026.2.52556 or later.","detection":"Defenders should monitor authentication logs for unexpected email address changes during verification flows, especially when paired with subsequent privilege-escalating actions; look for log entries showing successful email verification followed by anomalous permission changes for the same user account within a short time window.","tags":["privilege-escalation","auth-bypass","web-app","hub","jetbrains"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:46:36.223Z"}}