CVE-2026-123300
LowCVSS 2.7Summary
In JetBrains Hub before 2026.2.52519, missing authorization allowed users with read-only access to modify auth module group mappings.
Risk Assessment
Modifying group mappings can lead to privilege escalation and unauthorized access to resources.
Recommendation
Upgrade JetBrains Hub to version 2026.2.52519 or later and review permissions of read-only users.
Other vulnerabilities in JetBrains Hub
See all- CVE-2026-123299Low
In JetBrains Hub before 2026.2.52519, information disclosure via user search queries was possible.
- CVE-2026-123298Medium
In JetBrains Hub before 2026.2.52556, SMTP command injection via email verification was possible.
- CVE-2026-123297Medium
In JetBrains Hub before 2026.2.52519, two-factor authentication bypass was possible via the password reset flow.
- CVE-2026-123296High
In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible.
- CVE-2026-123295High
In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint.
- CVE-2026-123294Critical
In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow.
- CVE-2026-86480Critical
In JetBrains Hub before 2026.2.52442, an unauthenticated attacker could register a trusted service and gain superuser privileges.
- CVE-2026-56142Critical
In JetBrains Hub before versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, a privilege escalation vulnerability existed by attaching authentication details to accounts.
- CVE-2026-56141Critical
In JetBrains Hub before versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, account takeover via predictable restore codes was possible.
- CVE-2026-50242Critical
In JetBrains Hub before versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, authentication bypass via direct database access leading to administrative access was possible.
Original NVD description (English source)
In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings
Vulnerability data from NVD (NIST) · CISA KEV · EPSS