In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Jetbrains
  • Hub

Configuration 1 [-]

cpe:2.3:a:jetbrains:hub:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://www.jetbrains.com/privacy-security/issues-fixed/ cve-icon cve-icon
History

Fri, 02 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:jetbrains:hub:*:*:*:*:*:*:*:*

Thu, 01 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
First Time appeared Jetbrains
Jetbrains hub
Vendors & Products Jetbrains
Jetbrains hub

Wed, 30 Sep 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Email Sending via Trusted Address

Wed, 30 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: JetBrains

Published: 2026-09-30T15:17:50.888Z

Updated: 2026-09-30T15:48:39.223Z

Reserved: 2026-09-25T17:02:06.924Z

Link: CVE-2026-100266

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-09-30T16:16:57.707

Modified: 2026-10-02T16:47:10.860

Link: CVE-2026-100266

cve-icon Redhat

No data.