CVE-2025-48391
📋 TL;DR
This vulnerability in JetBrains YouTrack allows unauthorized deletion of issues due to missing permission checks in the API. Any YouTrack instance with users who shouldn't have issue deletion permissions is affected. The flaw enables privilege escalation where users can delete issues they shouldn't have access to.
💻 Affected Systems
- JetBrains YouTrack
📦 What is this software?
Youtrack by Jetbrains
⚠️ Risk & Real-World Impact
Worst Case
Malicious or compromised user account could delete all issues in the system, causing complete data loss and operational disruption.
Likely Case
Internal user with limited permissions accidentally or intentionally deletes issues they shouldn't have access to, causing data loss and workflow disruption.
If Mitigated
With proper access controls and auditing, impact is limited to minor data loss that can be restored from backups.
🎯 Exploit Status
Exploitation requires authenticated access but minimal technical skill. The vulnerability is in API endpoints that should have permission checks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.1.76253
Vendor Advisory: https://www.jetbrains.com/privacy-security/issues-fixed/
Restart Required: Yes
Instructions:
1. Backup your YouTrack instance. 2. Download YouTrack version 2025.1.76253 or later from JetBrains. 3. Follow JetBrains upgrade instructions for your deployment method (Docker, standalone, etc.). 4. Restart the YouTrack service.
🔧 Temporary Workarounds
Restrict API Access
allTemporarily restrict access to YouTrack API endpoints using network controls or web application firewall rules.
Enhanced Monitoring
allImplement strict monitoring and alerting for issue deletion events in YouTrack logs.
🧯 If You Can't Patch
- Implement strict access controls and review all user permissions to minimize attack surface
- Enable comprehensive auditing and alerting for all issue deletion activities
🔍 How to Verify
Check if Vulnerable:
Check YouTrack version in Administration → Global Settings → About. If version is earlier than 2025.1.76253, you are vulnerable.Check Version:
Check YouTrack web interface at Administration → Global Settings → About, or check container/process version if using Docker/standalone.Verify Fix Applied:
After upgrade, verify version is 2025.1.76253 or later in Administration → Global Settings → About. Test issue deletion with limited permission accounts.📡 Detection & Monitoring
Log Indicators:
- Unusual patterns of issue deletion events
- Issue deletions from users without appropriate permissions
- Multiple rapid issue deletions
Network Indicators:
- Unusual API call patterns to issue deletion endpoints
- Bursts of DELETE requests to YouTrack API
SIEM Query:
source="youtrack" AND (event_type="issue_deleted" OR action="delete") | stats count by user, src_ip