What is the CVSS score of EUVD-2026-33378?

EUVD-2026-33378 has a CVSS 3.1 base score of 3.4 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-33378?

Yes, a patch is available for EUVD-2026-33378. Update the affected software to the latest version immediately.

JetBrains YouTrack EUVD-2026-33378

| CVE-2026-49370 LOW

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-05-29 JetBrains

GHSA-cvxx-fgp2-3x79

Information Disclosure Youtrack

3.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.4 LOW

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 29, 2026 - 20:02 EUVD

Analysis Generated

May 29, 2026 - 18:58 vuln.today

DescriptionCVE.org

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

AnalysisAI

Information disclosure in JetBrains YouTrack before version 2026.1.13162 exposes sensitive data through fetchApp requests, exploitable by a high-privileged user with required interaction. The CVSS vector (PR:H/UI:R/S:C) indicates this requires an authenticated administrator-level account, some form of user interaction, and crosses a security scope boundary - meaning disclosed data may reach an unintended security context. No public exploit exists and no KEV listing is present; this is a low-severity (CVSS 3.4) internal information leakage issue most relevant to hardened or compliance-sensitive YouTrack deployments.

Technical ContextAI

JetBrains YouTrack is a web-based issue tracker and project management tool. The affected component is the fetchApp request mechanism, likely an internal API or application-fetching endpoint that inadvertently includes sensitive data in its responses or transmitted payloads. The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the application actively places sensitive material - such as tokens, configuration values, or internal metadata - into outbound data that should not contain it. The CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* indicates all YouTrack versions prior to 2026.1.13162 are affected across all platforms. The Changed Scope (S:C) in the CVSS vector is notable for an information disclosure: it implies the exposed data crosses a security boundary, potentially reaching a component or user context outside the original trust domain of the request.

RemediationAI

The primary remediation is to upgrade JetBrains YouTrack to version 2026.1.13162 or later, which contains the vendor-confirmed fix per the JetBrains security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. Given that exploitation requires high privileges (PR:H) and user interaction (UI:R), organizations that cannot immediately patch can reduce residual risk by auditing administrator accounts and restricting admin-level access to YouTrack to only necessary personnel, thereby shrinking the pool of users capable of triggering the fetchApp disclosure. Additionally, reviewing network segmentation to ensure YouTrack's internal API endpoints are not unnecessarily exposed to broader network segments may limit the scope of any cross-boundary data leakage identified by the Changed Scope vector. These workarounds do not eliminate the vulnerability and patching remains the definitive fix.