CVE-2026-123294

Full vulnerability record from the local CVENow database.

Description

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

Severity

CRITICAL

CVSS score

9.6 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-06 11:17:08.140000

Last modified

2026-11-06 15:17:15.053000

View original CVE JSON

{
  "id": "CVE-2026-123294",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-06T11:17:08.140",
  "lastModified": "2026-11-06T15:17:15.053",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "JetBrains",
          "product": "Hub",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "2026.2.52556",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-11-06T14:01:09.578933Z",
          "id": "CVE-2026-123294",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-915"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.jetbrains.com/privacy-security/issues-fixed/",
      "source": "[email protected]"
    }
  ]
}