Brief Summary: CVE-2026-49367 — JetBrains IntelliJ IDEA Guest User Command Execution via Missing Authorization in Code With Me

Introduction

A missing authorization check in Code With Me, the collaborative development feature in JetBrains IntelliJ IDEA, lets a guest user execute commands on the host machine. The guest bypasses the permission model entirely, even though that model should restrict guests to read-only access. IntelliJ IDEA is the leading Java IDE in an ecosystem of 11.4 million recurring active JetBrains users, so this CVSS 8.0 vulnerability is a meaningful risk to enterprise development environments where collaborative coding sessions are routine.

Technical Information

Root Cause: CWE-862 and the Absent Authorization Check

CVE-2026-49367 is classified under CWE-862: Missing Authorization. The classification means authorization enforcement is absent altogether. A check that exists but is flawed or bypassable would fall under CWE-863: Incorrect Authorization instead. No middleware, filter, or gatekeeper checks whether a Code With Me guest user has the right to invoke command execution pathways on the host machine.

MITRE's extended description of CWE-862 notes that authorization weaknesses often appear when a single-user application is ported to a multi-user environment, because developers may not consider that different users will have different access rights. That maps directly onto IntelliJ IDEA. The IDE began as a single-user desktop application, and Code With Me introduced multi-user access without fully extending authorization controls to every code path.

The Code With Me Permission Model

Code With Me is the built-in collaborative development feature in IntelliJ IDEA and other JetBrains IDEs, used for real-time pair programming. A session has a host (the IDE owner) and one or more guests who join through an invitation link. The host can assign one of four permission levels:

Guests start with read-only permissions by default. They cannot edit files, use the terminal, or execute code without explicit host approval. Because of this vulnerability, a guest could execute commands on the host machine regardless of their assigned permission level. The command execution code path had no authorization check at all to enforce the guest's permission boundaries.

Attack Flow

Based on the CVE description and the characteristics of CWE-862, exploitation follows this sequence:

1. Session Entry: An attacker joins a Code With Me session as a guest. They might obtain an invitation link, potentially through social engineering, or be invited directly by a host who does not suspect malicious intent.

2. Authorization Bypass: The guest invokes command execution on the host machine. With no authorization check in place, the IDE never verifies whether the guest's permission level (e.g., Read-only) permits the action. CWE-862 flaws are commonly exploited through forced browsing (directly accessing resources that lack authorization checks) and API endpoint exploitation (calling functions or endpoints where authorization was never implemented). Here, the guest likely reaches an internal IDE command execution API or service endpoint that was never gated with guest authorization logic.

3. Command Execution: Commands run on the host operating system with the host user's privileges. Depending on the host's environment, that could give the attacker source code repositories, credentials stored in configuration files, CI/CD pipeline tokens, and a path into the broader network.

Impact Analysis

MITRE documents the consequences of CWE-862 across several impact scopes:

Relationship to CVE-2025-57728

CVE-2025-57728, a closely related vulnerability, was published on August 20, 2025, and affects IntelliJ IDEA before 2025.2. It is classified as CWE-863 (Incorrect Authorization) and allowed a Code With Me guest to discover hidden files. The move from CWE-863 (a check exists but is flawed) to CWE-862 (no check exists at all) suggests that the Code With Me authorization model has command execution pathways that were never instrumented with authorization logic, as opposed to paths where authorization was implemented incorrectly. The escalation warrants a broader audit of every guest-accessible surface in the IDE.

Affected Systems and Versions

All versions of JetBrains IntelliJ IDEA before 2026.1.1 are affected. The NVD entry gives only the generic description "IntelliJ IDEA before 2026.1.1" and names no edition, which suggests both the Community and Ultimate editions are impacted. The fix ships in version 2026.1.1.

The vulnerability affects installations where Code With Me is enabled and in use. Installations that have never used Code With Me, or that have the plugin disabled, are not exposed to this particular attack vector, but upgrading is still recommended.

Vendor Security History

IntelliJ IDEA has had several security issues over the past two years, with a notable cluster in authorization and access control:

Two guest-related authorization failures in Code With Me (CVE-2025-57728 and CVE-2026-49367) point to a systemic gap in the feature's authorization model. JetBrains does run a mature CVE response process. It operates its own CVE Numbering Authority and publishes remediation guidance promptly. Even so, the pattern suggests Code With Me would be better served by a comprehensive review of its authorization framework than by individual fixes.

In January 2021, The New York Times reported that unknown parties may have embedded malware in JetBrains TeamCity software in connection with the SolarWinds incident. JetBrains said it had not been contacted by any government or security agency and had not taken part in or been involved in the attack. The matter remains unresolved, but it put JetBrains in the spotlight of supply chain security concerns.

References

• NVD: CVE-2026-49367
• JetBrains Fixed Security Issues
• JetBrains Privacy and Security
• CWE-862: Missing Authorization
• NVD: CVE-2025-57728 (Prior Code With Me Authorization Issue)
• NVD: CVE-2026-41882
• Code With Me Enterprise User Guide
• Proofpoint: 2026 Vulnerability Exploitation in the Wild
• CTI Labs: JetBrains IntelliJ IDEA Vulnerability Demands Patching
• Tenable: JetBrains IntelliJ IDEA Arbitrary Local File Read (CVE-2026-41882)
• JetBrains Blog: Meet Code With Me
• Understanding CWE-862: Missing Authorization (Medium)
• JetBrains Wikipedia
• JetBrains Annual Highlights 2023