JetBrains Hub vulnerabilities
25 published CVEs name JetBrains Hub among the affected products.
- 25Published CVEs25 of them scored
- 14Last 12 monthspublished in the last year
- 6Critical3 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-123300
In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings
JetBrains · Hub
Low2.7 - CVE-2026-123299
In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible
JetBrains · Hub
Low3.1 - CVE-2026-123298
In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible
JetBrains · Hub
Medium5.0 - CVE-2026-123297
In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow
JetBrains · Hub
Medium6.8 - CVE-2026-123296
In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible
JetBrains · Hub
High7.5 - CVE-2026-123295
In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint
JetBrains · Hub
High8.1 - CVE-2026-123294
In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow
JetBrains · Hub
Critical9.6 - CVE-2026-100266
In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address
JetBrains · Hub
High7.7 - CVE-2026-86480
In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges
JetBrains · Hub
Critical9.8 - CVE-2026-50242
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database…
JetBrains · Hub
Critical10.0