What is the CVSS score of CVE-2026-49370?

CVE-2026-49370 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of JetBrains YouTrack are affected by CVE-2026-49370?

JetBrains YouTrack versions prior to 2026.1.13162 contain an unauthenticated information disclosure vulnerability allowing unauthorized remote access to sensitive project data without user…. A patch is available.

How to fix or mitigate CVE-2026-49370?

Within 24 hours, inventory all JetBrains YouTrack instances across your environment and document which systems store sensitive project information, user credentials, or business data. Within 7 days, upgrade all affected YouTrack installations to version 2026.1.13162 or later, prioritizing instances containing confidential or regulated information. Within 30 days, verify successful patch deployment across all systems and conduct access log reviews for suspicious activity or indicators of unauthorized data extraction prior to patching.

JetBrains YouTrack CVE-2026-49370

EUVD-2026-33378 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-05-29 JetBrains

GHSA-cvxx-fgp2-3x79

Information Disclosure Youtrack JetBrains

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network request to fetchApp endpoint (AV:N/AC:L/PR:N/UI:N) yields confidentiality-only disclosure with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 22, 2026 - 06:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 06:22 vuln.today

cvss_changed

Severity Changed

Jul 22, 2026 - 06:22 NVD

LOW HIGH

CVSS changed

Jul 22, 2026 - 06:22 NVD

3.4 (LOW) 7.5 (HIGH)

Patch available

May 29, 2026 - 20:02 EUVD

Analysis Generated

May 29, 2026 - 18:58 vuln.today

DescriptionNVD

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

AnalysisAI

Information disclosure in JetBrains YouTrack before 2026.1.13162 allows remote unauthenticated attackers to obtain sensitive data through fetchApp requests. The flaw exposes confidential information without requiring authentication or user interaction, but carries no integrity or availability impact. There is no public exploit identified at time of analysis, and the EPSS score of 0.00% reflects no observed exploitation activity.

Technical ContextAI

YouTrack is JetBrains' web-based issue-tracking and project-management server, commonly deployed by development teams for bug tracking, agile boards, and knowledge bases. The vulnerability resides in the handling of 'fetchApp' requests - an endpoint associated with YouTrack's application/widget fetching mechanism - which improperly returns or exposes data that should remain confidential. The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the server transmits sensitive information within a response where it should not be present, allowing an attacker who can reach the endpoint to read data they are not authorized to see. The affected component is identified generically in CPE as cpe:2.3:a:jetbrains:youtrack, covering all versions prior to the fixed build 2026.1.13162.

RemediationAI

Vendor-released patch: upgrade YouTrack to version 2026.1.13162 or later, which is the primary and recommended fix per JetBrains (see https://www.jetbrains.com/privacy-security/issues-fixed/). Self-managed YouTrack Server administrators should apply the update promptly; JetBrains-hosted InCloud instances are patched by the vendor. As a compensating control until patching, restrict network exposure of the YouTrack instance by placing it behind a VPN or IP-allowlist and limiting reachability of the affected fetchApp request path at a reverse proxy or WAF - noting the trade-off that overly broad filtering of application/widget fetch endpoints may break legitimate YouTrack app or widget functionality. Monitor access logs for anomalous requests to the fetchApp endpoint. No exact interim workaround is documented by the vendor, so upgrading to 2026.1.13162 remains the definitive remediation.