CVE-2026-123294: Privilege Escalation in JetBrains Hub

CVE-2026-123294 is a privilege escalation vulnerability in JetBrains Hub, the centralized repository management and collaboration system by JetBrains. The flaw exists in the email verification flow: an authenticated attacker could modify authentication details during this critical phase, escalating privileges without authorization. It affects all JetBrains Hub versions before 2026.2.52556.

With a CVSS score of 9.6, this is a critical vulnerability. Signals from social media and the official NVD description agree: the issue is legitimate and verified. The vendor released an official patch on the same disclosure date, 2026-11-06. Signal volume remains moderate (3 mentions in 24 hours), suggesting the information is starting to circulate among security professionals but has not yet reached maximum visibility.

For defenders: prioritize and execute the update to JetBrains Hub 2026.2.52556 or later immediately. Before updating, audit system and authentication logs for any anomalous activity related to email verification processes in recent days. If JetBrains Hub is integrated with critical authentication or authorization systems, consider temporary isolation if immediate patching is not possible.