JetBrains Hub

• CVE-2026-100266 High 7.7 In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address 0.2%
• CVE-2026-86480 Critical 9.8 In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges 0.6%
• CVE-2026-50242 Critical 10.0 In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was po 0.6%
• CVE-2026-56142 Critical 9.6 In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible 0.6%
• CVE-2026-56141 Critical 9.8 In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible 0.5%
• CVE-2026-32229 Medium 6.8 In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled 0.2%
• CVE-2026-25848 Critical 9.1 In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible 0.5%
• CVE-2025-64683 Medium 5.3 In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API 0.2%
• CVE-2025-64682 Low 2.7 In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit 0.2%
• CVE-2025-64681 Low 2.7 In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations 0.2%
• CVE-2025-24456 Medium 6.7 In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping 0.3%
• CVE-2024-50573 Medium 4.3 In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services 0.2%
• CVE-2024-38507 Low 3.5 In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible 0.2%
• CVE-2022-48477 Medium 4.1 In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing 0.5%
• CVE-2022-48429 Medium 4.6 In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible 0.6%
• CVE-2022-45471 Low 3.5 In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address 0.6%
• CVE-2022-34894 Low 3.5 In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services 0.6%
• CVE-2022-29811 Medium 6.1 In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible. 0.5%