Skip to main content

JetBrains YouTrack EUVDEUVD-2026-72494

| CVE-2026-86478 CRITICAL
Authentication Bypass by Spoofing (CWE-290)
2026-09-07 JetBrains GHSA-w44j-qc22-m82h
Authentication Bypass Youtrack JetBrains
9.8
CVSS 3.1 · Vendor: JetBrains
Share

Severity by source

Vendor (JetBrains) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
9.8 CRITICAL

Unauthenticated, network-reachable Helpdesk with no interaction yields full takeover of the targeted account (C/I/A:H); scope unchanged as impact stays within the application.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (JetBrains).

CVSS VectorVendor: JetBrains

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch available
Sep 07, 2026 - 17:17 EUVD
Analysis Generated
Sep 07, 2026 - 17:12 vuln.today
CVE Published
Sep 07, 2026 - 16:26 cve.org
CRITICAL 9.8

DescriptionCVE.org

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address

AnalysisAI

Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing accounts by asserting a victim's email address without proving ownership of it. All YouTrack builds before 2025.3.161254 and 2026.1.14042 are affected. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires that the YouTrack Helpdesk feature is enabled and network-reachable by the attacker, and that the attacker knows or guesses the email address of an existing target account to assert. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, and full compromise of the targeted account (confidentiality, integrity, availability of that account's data). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: upgrade to YouTrack 2025.3.161254 or 2026.1.14042 (or later) - pick the fixed build matching your release line. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Disable YouTrack Helpdesk or restrict network access to it as an interim protective measure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Youtrack

View all
CVE-2026-62422 CRITICAL
9.8 Jul 14

Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct
CVE-2024-54154 CRITICAL
9.8 Dec 04

In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox. Rated c
CVE-2022-24442 CRITICAL
9.8 Feb 25

JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
CVE-2021-43185 CRITICAL
9.8 Nov 09

JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. Rated critical severity (CVSS 9.8), this

CVE-2021-25770 CRITICAL
9.8 Feb 03

In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e
CVE-2019-12852 CRITICAL
9.8 Jul 03

An SSRF attack was possible on a JetBrains YouTrack server. Rated critical severity (CVSS 9.8), this vulnerability is re
CVE-2019-12867 CRITICAL
9.8 Jul 03

Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. Rated critical severity (C
CVE-2019-12866 CRITICAL
9.8 Jul 03

An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains

CVE-2019-12850 CRITICAL
9.8 Jul 03

A query injection was possible in JetBrains YouTrack. Rated critical severity (CVSS 9.8), this vulnerability is remotely
CVE-2026-75045 CRITICAL
9.1 Aug 17

Unauthenticated database backup disclosure in JetBrains YouTrack before 2025.3.156085, 2026.1.13913, and 2026.2.18112 al
CVE-2021-37549 CRITICAL
9.1 Aug 06

In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. Rated critical severity (CVSS 9.1),
CVE-2026-86482 HIGH
8.8 Sep 07

Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alt

Same weakness CWE-290 – Authentication Bypass by Spoofing

View all
CVE-2024-54085 CRITICAL
9.8
CVE-2023-50224 MEDIUM
6.5
CVE-2024-4358 CRITICAL POC
9.8
CVE-2018-5353 CRITICAL POC
9.8
CVE-2023-51350 CRITICAL POC
9.8
CVE-2022-3180 CRITICAL
9.8
CVE-2025-66570 CRITICAL POC
10.0
CVE-2025-49002 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-72494 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy