CVE Intelligence

Jetbrains Hub vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Jetbrains Hub: 10 record(s), with affected versions and fixes.
cpe:2.3:a:jetbrains:hub

CVE-2026-100266 Medium · 6.5 CWE-862 Sep 30, 2026
Missing Authorization in Jetbrains Hub
In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address
CVE-2026-86480 Critical · 9.8 CWE-306 Sep 7, 2026
Missing Authentication for Critical Function in Jetbrains Hub
In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges
CVE-2026-56142 High · 8.8 CWE-915 Jun 19, 2026
Mass Assignment in Jetbrains Hub
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible
CVE-2026-56141 Critical · 9.8 CWE-338 Jun 19, 2026
JetBrains Hub: account takeover via predictable restore codes (CWE-338)
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible
CVE-2026-50242 Critical · 9.8 CWE-306 Jun 19, 2026
JetBrains Hub authentication bypass via direct database access (CVE-2026-50242)
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
CVE-2026-32229 Medium · 6.8 CWE-290 Mar 11, 2026
Authentication Bypass by Spoofing in Jetbrains Hub
In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled
CVE-2026-25848 Critical · 9.8 CWE-306 Feb 9, 2026
JetBrains Hub Authentication Bypass (CWE-306)
In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible
CVE-2025-64683 High · 7.5 CWE-362 Nov 10, 2025
Race Condition in Jetbrains Hub
In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API
CVE-2025-64682 Low · 3.7 CWE-362 Nov 10, 2025
Race Condition in Jetbrains Hub
In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit
CVE-2025-64681 Low · 3.7 CWE-862 Nov 10, 2025
Missing Authorization in Jetbrains Hub
In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations