CVE-2026-123295High· 8.1▾ TwilightIn JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint
Hub < 2026.2.52519Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123296High· 7.5In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible
CVE-2026-123299Low· 3.1In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible
CVE-2026-123852High· 7.4In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates
CVE-2026-123280High· 8.1In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports
CVE-2026-123279Critical· 9.0In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators
CVE-2026-123289Medium· 5.4In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files