Server-Side Request Forgery Vulnerability in JetBrains IntelliJ IDEA
CVE-2026-123844

5.3MEDIUM

Key Information:

Vendor

Jetbrains
Status
Intellij Idea
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123844?

In JetBrains IntelliJ IDEA prior to version 2026.3, a server-side request forgery vulnerability exists that enables attackers to exploit custom plugin repositories. This flaw allows unauthorized access to internal systems, potentially leading to sensitive data exposure or manipulation. Developers and organizations using IntelliJ IDEA are urged to update their software to mitigate this risk and ensure their development environment remains secure.

Affected Version(s)

IntelliJ IDEA 0 < 2026.3

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.