CVE-2026-75049

This is not a typical IDOR vulnerability. The distinction matters: classic IDOR involves manipulating an identifier in a request to access another user's resource. Here, the attacker doesn't manipulate anything—they call the draft creation endpoint normally, and the endpoint voluntarily returns content it shouldn't. This is an insecure direct object reference in the response construction, and it changes how you audit for similar issues. The root cause is a prefetch or prefill pattern in the draft creation endpoint. When a user creates a draft referencing an article, the API returns the article's content as part of the response—likely a UX convenience to give users a head start. The developer verified the user was authenticated and could create drafts in their project, but never asked whether that user should be able to read the source article. Authorization was enforced at the project level but the data access happened at the article level—a vertical privilege escalation enabled by misaligned security boundaries. The CVSS 6.5 rating is misleading. It reflects a narrow exploit window (the unauthorized read only occurs during draft creation) but obscures two critical factors. First, this endpoint functions as an enumeration engine—if draft creation accepts a project identifier, an attacker can script across all projects and pull prefill data for every article the system can reach, without triggering the access-denied logs that would alert traditional authorization monitoring. Second, the vulnerability class recurs systematically: authenticated-user endpoints that return dependent resources without re-authorizing against the source. Cloud storage APIs, CMS platforms, and collaboration tools all exhibit this pattern. The fix that JetBrains applies to this endpoint will create a new code path that future developers may not understand, and the same gap likely exists in other prefill mechanisms. Audit your API for any authenticated endpoint that returns data from a resource owned by a different principal. The presence of prefill, prefetch, or draft-referencing functionality should trigger an explicit authorization gate regardless of how convenient the feature is. Check draft creation, comment import, template cloning, and attachment endpoints specifically. The security boundary belongs around each resource being accessed, not at the entry point.

Reviewed through automated stages and approved by a human before publication.