Hub
by Jetbrains
CVEs (36)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-50242 | Cri | 0.65 | 10.0 | 0.01 | Jun 19, 2026 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible | ||
| CVE-2026-56142 | Cri | 0.64 | 9.9 | 0.01 | Jun 19, 2026 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible | ||
| CVE-2026-56141 | Cri | 0.64 | 9.8 | 0.01 | Jun 19, 2026 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible | ||
| CVE-2022-25262 | Cri | 0.64 | 9.8 | 0.01 | Feb 25, 2022 | In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. | ||
| CVE-2021-43183 | Cri | 0.64 | 9.8 | 0.01 | Nov 9, 2021 | In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed. | ||
| CVE-2021-36209 | Cri | 0.64 | 9.8 | 0.01 | Aug 6, 2021 | In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset. | ||
| CVE-2026-25848 | Cri | 0.59 | 9.1 | 0.00 | Feb 9, 2026 | In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible | ||
| CVE-2022-25260 | Cri | 0.59 | 9.1 | 0.02 | Feb 25, 2022 | JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). | ||
| CVE-2022-24327 | Hig | 0.49 | 7.5 | 0.01 | Feb 25, 2022 | In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions. | ||
| CVE-2021-43182 | Hig | 0.49 | 7.5 | 0.01 | Nov 9, 2021 | In JetBrains Hub before 2021.1.13415, a DoS via user information is possible. | ||
| CVE-2021-43180 | Hig | 0.49 | 7.5 | 0.01 | Nov 9, 2021 | In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible. | ||
| CVE-2021-31901 | Hig | 0.49 | 7.5 | 0.01 | May 11, 2021 | In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group. | ||
| CVE-2020-11691 | Hig | 0.49 | 7.5 | 0.01 | Apr 22, 2020 | In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible. | ||
| CVE-2019-12847 | Hig | 0.47 | 7.2 | 0.01 | Jul 3, 2019 | In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. It is only relevant in cases where a password has not changed since 2017, and if the audit log still contains events from before that period. | ||
| CVE-2026-32229 | Med | 0.44 | 6.8 | 0.00 | Mar 11, 2026 | In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled | ||
| CVE-2025-24456 | Med | 0.44 | 6.7 | 0.00 | Jan 21, 2025 | In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping | ||
| CVE-2022-24328 | Med | 0.42 | 6.5 | 0.01 | Feb 25, 2022 | In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS. | ||
| CVE-2021-37540 | Med | 0.42 | 6.5 | 0.01 | Aug 6, 2021 | In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used. | ||
| CVE-2021-25759 | Med | 0.42 | 6.5 | 0.01 | Feb 3, 2021 | In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user. | ||
| CVE-2022-29811 | Med | 0.40 | 6.1 | 0.00 | Apr 28, 2022 | In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible. |
- risk 0.65cvss 10.0epss 0.01
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
- risk 0.64cvss 9.9epss 0.01
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible
- risk 0.64cvss 9.8epss 0.01
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible
- risk 0.64cvss 9.8epss 0.01
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible.
- risk 0.64cvss 9.8epss 0.01
In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed.
- risk 0.64cvss 9.8epss 0.01
In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.
- risk 0.59cvss 9.1epss 0.00
In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible
- risk 0.59cvss 9.1epss 0.02
JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF).
- risk 0.49cvss 7.5epss 0.01
In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions.
- risk 0.49cvss 7.5epss 0.01
In JetBrains Hub before 2021.1.13415, a DoS via user information is possible.
- risk 0.49cvss 7.5epss 0.01
In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible.
- risk 0.49cvss 7.5epss 0.01
In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group.
- risk 0.49cvss 7.5epss 0.01
In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible.
- risk 0.47cvss 7.2epss 0.01
In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. It is only relevant in cases where a password has not changed since 2017, and if the audit log still contains events from before that period.
- risk 0.44cvss 6.8epss 0.00
In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled
- risk 0.44cvss 6.7epss 0.00
In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping
- risk 0.42cvss 6.5epss 0.01
In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS.
- risk 0.42cvss 6.5epss 0.01
In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used.
- risk 0.42cvss 6.5epss 0.01
In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user.
- risk 0.40cvss 6.1epss 0.00
In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.
Page 1 of 2