PT-2026-86852 · Jetbrains · Hub
CVE-2026-86480
·
Publicado
2026-09-07
·
Atualizado
2026-09-09
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
🚨Critical - JetBrains Hub Unauth Trusted Service Registration PrivEsc (CVE-2026-86480)
JetBrains Hub exposes a critical trusted-service registration endpoint where the service trust flag can be set without authentication. An unauthenticated attacker can register a malicious trusted service, then obtain superuser privileges via elevated service-to-Hub permissions. Properly authenticated service registration flows are not impacted.
👉Affected: JetBrains Hub < 2026.2.52442 | Upgrade to 2026.2.52442
Correção
Missing Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Hub