CVE-2026-123296

HighCVSS 7.5/10Last modified Nov 7, 2026

Description

In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 6, 2026
Last modified
Nov 7, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1232976.8In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flowCVE-2026-1232985.0In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possibleCVE-2026-1232993.1In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possibleCVE-2026-12337.5The Text to Speech for WP (AI Voices by Mementor) plugin for WordPress is vulnerable to sensitive information exposure in all versions up toCVE-2026-123305.4Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37,CVE-2026-1233002.7In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappingsCVE-2026-1233018.2In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possibleCVE-2026-1233027.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script eCVE-2026-1233047.8In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck pathCVE-2026-1233057.5In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote hostCVE-2026-1233067.4In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runsCVE-2026-1233076.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible
CVE-2026-123296: High severity, CVSS 7.5 | Vulnix