Jetbrains Hub

13 CVEs affecting Jetbrains Hub. Latest disclosed: 2026-03-11. Critical: 1, High: 0.

Top CVEs affecting Jetbrains Hub
CVESeverityScorePublishedSummary
CVE-2026-25848Critical9.12026-02-09In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible
CVE-2026-32229Medium6.82026-03-11In JetBrains Hub before 2026.1 possible on sign-in account mismatch with non-SSO auth and 2FA disabled
CVE-2025-24456Medium6.72025-01-21In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping
CVE-2022-29811Medium6.12022-04-28In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.
CVE-2025-64683Medium5.32025-11-10In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API
CVE-2022-48429Medium4.62023-03-27In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible
CVE-2024-50573Medium4.32024-10-28In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services
CVE-2022-48477Medium4.12023-04-24In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing
CVE-2024-38507Low3.52024-06-18In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible
CVE-2022-45471Low3.52022-11-18In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address
CVE-2022-34894Low3.52022-07-01In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services
CVE-2025-64682Low2.72025-11-10In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit
CVE-2025-64681Low2.72025-11-10In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations