JetBrains Hub versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429 contain a privilege escalation vulnerability (CWE-915) that allows an attacker to escalate privileges by attaching authentication details to accounts. This vulnerability can lead to complete compromise of affected systems due to its impact on confidentiality, integrity, and availability. The CVSS v3.1 base score is 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and scope change with high impact on all security properties. No official fix or patch has been announced or linked by the vendor as of the publication date.

Successful exploitation of this vulnerability allows an attacker with some level of privileges to escalate their access rights by attaching authentication details to accounts, potentially leading to full system compromise. The impact affects confidentiality, integrity, and availability at a high level, as indicated by the CVSS score of 9.6. This could enable unauthorized access to sensitive data, modification or deletion of critical information, and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor JetBrains advisories closely. Given the nature of the vulnerability, limiting user privileges and restricting access to trusted personnel may reduce risk. No vendor-provided temporary fixes or workarounds are currently documented.