CVE-2026-123294

Summary

In JetBrains Hub before version 2026.2.52556, a privilege escalation vulnerability (CWE-915) allowed authenticated low-privilege users to modify their email authentication details during the verification flow, potentially gaining elevated privileges without proper authorization.

Exploitability

Exploitation requires valid low-privilege user credentials and no user interaction, as the flaw exists in the server-side verification logic during email update.

Blast radius

Successful exploitation could allow attackers to escalate privileges within JetBrains Hub, compromising confidentiality and integrity of project data, but availability is unaffected.

Detection

Defenders should monitor authentication logs for unexpected email address changes during verification flows, especially when paired with subsequent privilege-escalating actions; look for log entries showing successful email verification followed by anomalous permission changes for the same user account within a short time window.

Prioritized remediation

Upgrade JetBrains Hub to version 2026.2.52556 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.