JetBrainsCVE-2026-86480

JetBrains Hub: missing authentication

Critical9.8CVE-2026-86480 · Published Sep 7, 2026 · updated Sep 9, 2026

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges

JetBrains advisory

Affected versions

Package	Affected	Fixed in
Hub Product	< 2026.2.52442	2026.2.52442

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-306

More JetBrains advisories

Date	Advisory	Severity	Fixed in
Sep 7	JetBrains IntelliJ IDEA: information disclosure Low3.3Sep 7 CVE-2026-865052026.2.2	Low3.3	2026.2.2
Sep 7	JetBrains GoLand: missing authentication Medium5.9Sep 7 CVE-2026-865062026.2.2.1	Medium5.9	2026.2.2.1
Sep 7	JetBrains YouTrack: information disclosure Medium6.8Sep 7 CVE-2026-864972026.2.18769	Medium6.8	2026.2.18769
Sep 7	JetBrains YouTrack: improper authorization High7.7Sep 7 CVE-2026-864982025.3.160480+1 more	High7.7	2025.3.160480+1 more
Sep 7	JetBrains YouTrack: missing authorization Medium4.3Sep 7 CVE-2026-864992026.1.14047	Medium4.3	2026.1.14047
Sep 7	In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user... Medium5.5Sep 7 CVE-2026-865002026.1.14047	Medium5.5	2026.1.14047

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.