JetBrains
Monthly
HTML injection in JetBrains YouTrack's VCS command failure notifications (before 2026.2.19422) allows an authenticated attacker with high privileges to inject arbitrary HTML into notifications, potentially leading to content spoofing or script execution, but a victim must view the crafted notification. The vulnerability requires high attack complexity, and no public exploit code or active exploitation has been identified. Despite the low CVSS score of 2.0, it is a genuine XSS flaw that should be remediated by upgrading to version 2026.2.19422 or later.
JetBrains YouTrack before 2026.2.19197 fails to enforce read permissions when creating a project from a custom template, allowing an authenticated low-privileged user to read template data they are not authorized to access. This missing authorization flaw (CWE-862) has a low confidentiality impact (CVSS 3.1) and requires high attack complexity, a valid account, and the existence of an unreadable custom template; no public exploit code has been identified. The vendor has released a patch in version 2026.2.19197.
Credential disclosure in JetBrains YouTrack before 2026.2.19197 lets an authenticated user who can edit an existing integration's configuration URL redirect the integration's stored credentials to an attacker-controlled endpoint by simply changing that URL. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity, low-privilege flaw with high confidentiality impact and no integrity or availability effect, consistent with a credential-theft bug rather than code execution or full takeover; no public exploit identified at time of analysis, and no exploitation status is confirmed by CISA KEV for this CVE.
Improper authorization in JetBrains YouTrack before 2026.2.19197 allows an authenticated user with restricted project permissions to edit and hide other users' comments. The flaw is an incorrect authorization check (CWE-863) that yields only integrity impact - no data disclosure or service disruption - and exploitation requires an existing YouTrack account. No public exploit code has been identified at the time of analysis, and a vendor patch is available in version 2026.2.19197.
Stored cross-site scripting in JetBrains YouTrack before 2026.2.19197 allows an attacker with privileges to create or modify workflows-effectively a project administrator or workflow author-to store script content that is later rendered in a workflow error notification toast. The victim must trigger the affected workflow error path (UI:R) for the payload to execute in their authenticated YouTrack browser session; this is not a remote unauthenticated attack against default configurations, and the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N keeps confidentiality and integrity impact low. Vendor-released patch 2026.2.19197 is available, and no public exploit identified at time of analysis.
Denial of service in JetBrains YouTrack affects all builds before 2026.2.19197, where a project administrator can craft a notification template that drives uncontrolled resource consumption on the server. The requirement for an authenticated account holding project Admin rights (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5) confines realistic exposure to malicious or compromised administrators rather than ordinary or anonymous users, and the impact is limited to availability with no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, though JetBrains has shipped a vendor patch in 2026.2.19197 and the flaw is tracked in ENISA EUVD as EUVD-2026-90018.
Missing authorization in the notification template preview of JetBrains YouTrack (versions before 2026.2.19197) allows an authenticated attacker who holds Project Administrator rights to read issues that are otherwise restricted from them. The flaw is network-exploitable with low attack complexity and no victim interaction, but the CVSS vector (PR:H) means the attacker must already be a privileged, semi-trusted insider within a project, which is why the score stays at 4.9 (Medium). There is no public exploit identified at time of analysis and no KEV listing; the vendor has released a fix in YouTrack 2026.2.19197 (tracked as EUVD-2026-90016).
JetBrains YouTrack before 2026.2.19197 contains a broken access control vulnerability (CWE-862) that allows authenticated users with low privileges to read information from projects they are not authorized to access via several endpoints lacking authorization checks. The flaw requires a valid account and impacts only confidentiality; no data modification or privilege escalation is possible. It is rated low severity (CVSS 2.7) and no public exploit has been identified at time of analysis.
JetBrains YouTrack before 2026.2.19197 can disclose integration credentials to an authenticated user who holds the low-level Admin Read permission through import configurations, allowing that user to view secrets that should remain restricted. The flaw is CWE-863 incorrect authorization with a vendor CVSS score of 3.3 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N), and the independent assessment further narrows impact to confidentiality only (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N). Exploitation requires high privileges, high attack complexity, and a vulnerable instance that has integrations with stored credentials; no public exploit identified at time of analysis, and vendor-released patch 2026.2.19197 is available, so real-world urgency is low.
Authorization bypass in JetBrains YouTrack before 2026.2.19197 lets an authenticated low-privileged user circumvent a helpdesk project's Authorized Reporters allowlist and file reports that the configuration was meant to block. The issue is network-reachable with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3), but its impact is limited to integrity - unauthorized report submission - with no confidentiality or availability effect. It applies only to instances where a helpdesk project has actually been configured with an Authorized Reporters restriction, and the CVSS PR:L metric confirms the attacker must already hold a valid low-privileged account rather than being fully anonymous; no public exploit identified at time of analysis.
Authenticated project administrators in JetBrains YouTrack before 2026.2.19197 can read comments from projects they do not administer by exploiting a notification-template authorization bypass. This network-exploitable flaw requires an account with project-administrator privileges and no user interaction, resulting in a high-confidentiality impact with a scope change (CVSS 7.7). No public exploit or active exploitation has been identified at time of analysis.
Denial of service in JetBrains YouTrack allows an unauthenticated remote attacker to exhaust server CPU and request-handling threads by sending crafted email content that triggers catastrophic regular-expression backtracking in mailbox mail-rule filters, affecting all releases up to 2026.2.19197. The impact is limited to availability (CVSS:C:N/I:N/A:H, base score 5.9); there is no confidentiality or integrity effect. Exposure is contingent on a non-default, operator-dependent configuration - the mailbox integration must be enabled with regex-based mail-rule filters - and there is no public exploit identified at time of analysis, so this is a genuine but modest-priority availability issue rather than a broadly exploitable one.
Authenticated users of JetBrains Hub can send arbitrary emails from the server's trusted address due to a missing authorization check in versions before 2026.2.52366. The flaw requires a valid low-privilege Hub account (PR:L) and network reachability to the instance, but no user interaction; it allows spoofing outbound email, which can damage trust in the organization's sender identity. No public exploit has been identified at time of analysis, and the vendor has released a patch.
JetBrains Rider versions before 2026.2.1 allow the bundled AI Assistant to silently auto-update third-party skills - downloaded plugin-style capability packages that extend the assistant - without prompting the user or verifying the integrity of the update, enabling an attacker who controls or compromises a skill source the developer already trusts to push malicious skill content into the IDE. Exploitation is constrained: it requires the victim to run an affected Rider build with AI Assistant enabled and at least one third-party skill installed from an attacker-influenceable source, which is why the vector carries high attack complexity (AC:H) and only low confidentiality and integrity impact with no availability impact. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) applies; a vendor patch is available in Rider 2026.2.1.
Stored SMTP credentials in JetBrains YouTrack can be exposed to an already-authenticated administrator by changing the configured SMTP server host, affecting versions before 2026.2.18991. The issue is rated CVSS 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), so confidentiality impact is limited and exploitation requires high-privilege access - in practice an insider or an attacker who has already compromised an admin account in an instance where outbound email/notification delivery is configured. A vendor patch is available, and no public exploit has been identified at time of analysis.
Stored HTML injection in JetBrains YouTrack before 2026.2.18991 allows unauthenticated remote attackers to plant attacker-controlled markup into the application through the User-Agent HTTP header, which is subsequently stored and rendered to other users without adequate output encoding. Impact is limited to Low confidentiality with a scope change and no integrity or availability effect; exploitation depends on user interaction (UI:R), as a user - typically an operator reviewing stored request or user-agent data - must open the affected page for the injected HTML to render. There is no public exploit identified at time of analysis, and the vendor has released a fix in version 2026.2.18991.
Improper authorization in JetBrains YouTrack allows an authenticated, low-privileged user to change a knowledge-base article's visibility settings even though that account does not hold the article update permission. Only instances running versions before 2026.2.18991 are affected, and the impact is limited to low confidentiality and low integrity with no availability impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV); the vendor has released a fixed build, making this a modest-severity broken access control issue rather than a top-tier priority.
Stale authentication material tied to JetBrains YouTrack's mailbox integration continues to be accepted after a user's password reset in versions prior to 2026.2.18991, letting an actor who already holds the pre-reset credentials keep authenticating through that path when the reset should have invalidated them. The flaw is limited to deployments that use the mailbox integration feature and to accounts that have actually undergone a password reset; the impact is integrity-only (no confidentiality or availability effect), and the assessed complexity is higher than the base 5.3 vector implies because a preceding reset plus possession of the stale credentials are both required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the vendor has released a fix.
Improper access control in JetBrains YouTrack before 2026.2.18991 lets an authenticated user who has only view-only permission on a Gantt chart perform edit operations that the access model should block. The flaw is network-reachable but requires a valid YouTrack account (PR:L), has no user-interaction component, and is confined to low-severity integrity impact on scheduling/Gantt data with no confidentiality or availability effect (CVSS 4.3, CWE-863). There is no confirmed active exploitation (CISA KEV not listed) and no public exploit identified at time of analysis; the vendor has released a fixed build in 2026.2.18991.
Read-only users in JetBrains YouTrack can read project settings they are not entitled to see because the application fails to enforce an authorization check on that data path in all versions before 2026.2.18991. Exploitation requires a valid, authenticated YouTrack account at the read-only privilege level (CVSS vector PR:L), and the resulting impact is limited to disclosure of project settings configuration data - no modification of data, no privilege escalation, and no impact on availability. Scoring is low at CVSS 4.3, there is no CISA KEV listing and no public exploit code identified at time of analysis, and JetBrains has shipped a fixed build (2026.2.18991), so this is a low-priority information-disclosure issue that should be handled through normal patch cadence.
Server-side request forgery in JetBrains YouTrack before 2026.2.18991 lets an authenticated user coerce the server-side PDF export renderer into making outbound requests to attacker-influenced URLs by storing crafted XHTML content that is rendered when that content is exported to PDF. The assessed impact is confidentiality-only (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and the attack requires a valid YouTrack account plus write access to a stored field that reaches the PDF renderer; no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1, where the IDE injects a pprof HTTP server into profiled processes without any access control. An attacker with network connectivity to the developer workstation during an active profiling session can retrieve heap dumps, goroutine stacks, CPU traces, and in-memory data structures that may contain credentials, tokens, or sensitive application state. No public exploit code exists and this is not listed in CISA KEV; however, the attack requires only standard HTTP requests against an unauthenticated endpoint, making it trivially simple when the prerequisite conditions are met.
IntelliJ IDEA before version 2026.2.2 leaks project metadata to JetBrains Marketplace due to a missing project-trust check, exposing potentially sensitive project information without developer consent. The flaw requires local access and user interaction - specifically, a developer must open an untrusted project for the metadata transmission to occur. No public exploit code exists and no active exploitation has been identified; the impact is limited to a low-severity confidentiality breach (CVSS 3.3).
Server-Side Request Forgery (SSRF) in JetBrains IntelliJ IDEA before version 2026.2.2 allows an attacker to probe internal network resources by embedding a malicious Kubernetes spec-source URL inside a crafted project file. When a developer opens the untrusted project, the IDE automatically fetches the attacker-controlled URL, causing outbound requests to arbitrary hosts reachable from the developer's machine. Impact is limited to partial confidentiality loss (C:L) - internal network topology or service responses may be disclosed - with no integrity or availability consequences. No public exploit code is identified and the vulnerability is not listed in CISA KEV at time of analysis.
Terminal command input written to idea.log in JetBrains IntelliJ IDEA before 2026.2.2 exposes sensitive command-line strings to any local party that can read the IDE's diagnostic log. Classified as CWE-532 (Insertion of Sensitive Information into Log File), the flaw means that developers who type passwords, API keys, or tokens as command-line arguments in IntelliJ's integrated terminal inadvertently persist those secrets on disk in a plaintext log file. No public exploit has been identified at time of analysis, and the vendor-assigned CVSS score of 2.8 accurately reflects the constrained local-only, user-interaction-dependent attack surface.
Privilege escalation in JetBrains YouTrack before version 2026.1.14047 allows an authenticated user holding project update permissions to grant themselves the Project Admin role without proper authorization. The vulnerability stems from a missing escalation check (CWE-266: Incorrect Privilege Assignment) in the project permissions workflow, enabling a project contributor to cross a privilege boundary and assume administrative control over a project. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is known at time of analysis.
Authenticated users in JetBrains YouTrack before 2026.1.14047 can enumerate all group names via predefined search fields, bypassing group visibility permissions enforced elsewhere in the product. The flaw (CWE-862 Missing Authorization) means the access-control check applied to group visibility was not consistently applied to the predefined search field code path, leaking organizational structure to any logged-in user. No active exploitation has been identified and no public exploit code exists; CVSS 4.3 reflects the limited confidentiality impact.
Credential exfiltration in JetBrains YouTrack before 2026.2.18769 allows a project administrator to redirect stored mailbox credentials to an attacker-controlled server by modifying the mailbox host setting without triggering re-authentication. The missing re-authentication gate means any project admin who has been compromised, is malicious, or has temporarily elevated access can silently capture email account credentials (username and password) already stored in YouTrack. No public exploit has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Missing authorization (CWE-862) in JetBrains YouTrack before 2026.2.18769 allows any low-privileged authenticated user to read the email addresses of Helpdesk authorized reporters, who are external contacts registered to submit issues. The flaw bypasses the intended access control on the Helpdesk reporter roster, exposing personally identifiable contact data to users who should have no visibility into it. No public exploit is identified at time of analysis, and the vulnerability has been patched by JetBrains in version 2026.2.18769.
Missing server-side permission checks in JetBrains YouTrack before 2026.2.18687 allow any authenticated user to create knowledge base articles inside projects they are not authorized to access. The flaw is rooted in CWE-862 (Missing Authorization), where the article-creation endpoint omits the necessary access control validation against the caller's project permissions. No public exploit or active exploitation has been identified; the CVSS PR:L metric confirms exploitation is limited to users who already hold a valid YouTrack account.
Improper authorization in JetBrains YouTrack before 2026.2.18634 allows authenticated read-only users to create and modify whiteboard cards, exceeding their intended permissions. The flaw (CWE-863) bypasses YouTrack's role-based access controls for the whiteboard feature, enabling low-privileged users to perform write operations they should be denied. No public exploit code or active exploitation has been identified, and a vendor-confirmed fix is available. EPSS data was not provided; real-world risk is moderate given the authentication prerequisite.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows a high-privileged attacker to inject malicious scripts by uploading crafted project or organization icon files. When other authenticated users subsequently view the affected project or organization page, the stored payload executes in their browser context, enabling session data exposure or unauthorized in-application actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Insufficient permission checks on the app import endpoint in JetBrains YouTrack before version 2026.2.18634 allow an authenticated low-privileged user to overwrite bundled applications, achieving high-integrity impact across all unpatched deployments. The flaw is rooted in CWE-863 (Incorrect Authorization), meaning the server fails to validate that the requesting account holds sufficient privileges for a destructive write operation against pre-installed components. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in JetBrains YouTrack before 2026.2.18634 allows authenticated low-privileged users to enumerate and read private issues and starred folder contents belonging to other users across organizational boundaries by manipulating user profile API identifiers. The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/C:H) reflects straightforward network exploitation requiring only a valid session. No public exploit or KEV listing is present, but the low attack complexity and high confidentiality impact make this a meaningful data-exposure risk in multi-tenant or multi-organization YouTrack deployments.
Insecure Direct Object Reference in JetBrains YouTrack before version 2026.2.18634 permits authenticated users to access other users' private saved searches through the watchRules and issueListConfig API endpoints. The endpoints fail to enforce authorization checks on user-controlled object identifiers, allowing horizontal privilege escalation without elevated permissions. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Authorization bypass in JetBrains YouTrack's whiteboard feature allows authenticated read-only whiteboard users to modify canvas content they should only be able to view, by sending a crafted WebSocket message. Affected versions are all YouTrack releases before 2026.2.18634. The vulnerability stems from CWE-863 (Incorrect Authorization) - the server-side WebSocket handler fails to enforce the read-only permission boundary, accepting write operations from users who lack write privileges. No public exploit or active exploitation has been identified.
The generic VCS webhook handler in JetBrains YouTrack before 2026.2.18634 fails open when no webhook secret is configured, allowing unauthenticated remote callers to trigger webhook processing without any valid credential check. This CWE-306 flaw means that deployments where the webhook secret field is intentionally or inadvertently left blank accept all inbound webhook payloads as legitimate, bypassing the shared-secret verification mechanism. No public exploit code has been identified and the vulnerability is not in CISA KEV; the low CVSS score of 3.7 with AC:H accurately reflects that exploitation is constrained to misconfigured instances.
IP spoofing via forged HTTP headers in JetBrains YouTrack before 2026.2.18634 allows unauthenticated remote attackers to bypass Bitbucket webhook source validation, causing YouTrack to process attacker-crafted webhook payloads as if they originated from a legitimate Bitbucket server. The root cause is CWE-291 - reliance on IP address for authentication - specifically trusting client-controlled headers such as X-Forwarded-For to gate webhook acceptance. No public exploit has been identified at time of analysis, and JetBrains has released a patched build.
Stored XSS in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privilege users to inject AngularJS template expressions through issue assignee name fields, which are then evaluated as client-side JavaScript in the browsers of any user who views the affected issue or project board. The attack persists server-side, meaning every subsequent viewer triggers execution without further attacker interaction. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privileged users to inject persistent malicious scripts through custom field values displayed on Agile board cards. When a victim with an active YouTrack session views the affected Agile board, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code has been identified at time of analysis, and JetBrains has released a patched version.
Signed URL reuse in JetBrains YouTrack before 2026.2.18634 permits authenticated users to access restricted project icons they are not authorized to view. The flaw arises because signed URLs generated for project icon assets are not properly scoped or invalidated, allowing the same URL to be reused beyond its intended access context. No public exploit code has been identified and the vendor has issued a patch, making this a low-urgency but straightforward authorization control deficiency in a widely used issue tracker.
Cross-site scripting in JetBrains PyCharm's Quick Documentation rendering feature (before version 2026.2.1) enables code execution within the IDE process when a developer inspects documentation for a symbol from a maliciously crafted source. Attackers - including supply-chain adversaries embedding malicious HTML or JavaScript into Python package docstrings - can achieve code execution in PyCharm's local process context once the victim triggers Quick Documentation on an affected symbol. No public exploit has been identified at time of analysis, and JetBrains has released a fix in version 2026.2.1.
XML External Entity injection in JetBrains IntelliJ IDEA's Eclipse settings importer exposes sensitive local files on developer workstations running versions prior to 2026.2.1. The flaw (CWE-611) is triggered when a user imports a maliciously crafted Eclipse settings XML file, allowing an attacker to read arbitrary files accessible to the IDE process. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Git credentials are recorded in plaintext to IntelliJ IDEA's local IDE log file in all versions before 2026.1.5, exposing usernames, passwords, and tokens to any entity with read access to those log files. This CWE-532 information disclosure flaw affects the IDE's built-in Git integration subsystem and carries a high confidentiality impact (C:H in CVSS) because exposed credentials can grant full access to remote source code repositories. No public exploit has been identified at time of analysis, and CISA KEV lists no active exploitation.
Local file disclosure in JetBrains IntelliJ IDEA before 2026.2.1 is possible through an XXE injection in the Hadoop ResourceManager integration component. When a developer opens or processes a maliciously crafted XML-based project or configuration file, the unsanitized XML parser resolves external entity references and leaks arbitrary local files - including SSH keys, credentials, and application secrets - to the attacker. The CVSS vector (AV:L/UI:R) confines the risk to local or social-engineering attack paths; no public exploit or CISA KEV listing has been identified at time of analysis.
Server-Side Request Forgery in JetBrains IntelliJ IDEA before version 2026.2.1 allows an attacker who supplies a malicious project to cause the IDE's OpenAPI preview proxy to issue HTTP requests to arbitrary internal or external endpoints. The scope change (S:C in CVSS) indicates the proxy can reach resources beyond the local machine, enabling internal network reconnaissance or credential harvesting from metadata services. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the high confidentiality impact and developer-targeting nature elevate practical concern.
Server-Side Request Forgery in JetBrains IntelliJ IDEA before version 2026.2.1 allows network-accessible attackers to coerce the IDE into issuing arbitrary HTTP requests via the DevKit debug listener endpoint, requiring user interaction to trigger. The vulnerability carries a CVSS 5.4 (Medium) score with low confidentiality and integrity impact, and no availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting limited real-world exploitation pressure currently.
Command injection in JetBrains IntelliJ IDEA before 2026.2.1 enables arbitrary command execution through crafted Markdown preview content when a user opens and trusts a malicious project. The flaw (CWE-77) is constrained to trusted projects and requires the victim to interact with the Markdown preview, limiting its practical reach. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor-assigned CVSS score of 3.6 (Low) reflects these mitigating conditions.
Denial-of-service in JetBrains YouTrack before versions 2026.1.13901 and 2026.2.17950 allows authenticated remote attackers to exhaust server resources by submitting crafted type parameters, rendering the service unavailable. The vulnerability stems from uncontrolled resource consumption (CWE-770), where malformed input is not bounded before processing. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized cross-project article disclosure in JetBrains YouTrack allows any authenticated user to read restricted knowledge base articles belonging to projects they are not authorized to access, by exploiting a missing authorization check on the draft creation endpoint. Affected are all YouTrack deployments running versions before 2026.1.13903 and 2026.2.17950. No public exploit or active exploitation has been identified, but the low attack complexity and network-accessible vector make this trivially repeatable by any valid account holder on the instance.
Denial-of-service in JetBrains YouTrack before 2026.2.18177 allows an authenticated low-privileged user to exhaust server resources by uploading a decompression bomb to the import endpoint. The CVSS vector confirms full availability impact (A:H) with no confidentiality or integrity consequences. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, making this a moderate-priority internal threat requiring authenticated access.
Account enumeration in JetBrains YouTrack before version 2026.2.18112 exposes internal user accounts to any authenticated user through insufficient authorization controls on the users search endpoint. The root cause is CWE-862 (Missing Authorization): the endpoint performs no privilege check beyond requiring a valid session, allowing low-privilege users to systematically extract account identifiers across the entire instance. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the straightforward exploitation path makes patching a clear priority.
HTML injection in JetBrains IntelliJ IDEA before version 2026.2 enables silent user activity tracking through maliciously crafted IDE notifications. A remote attacker who can influence notification content - such as through a malicious plugin, crafted project file, or server response reflected as a notification - can inject arbitrary HTML payloads that silently load remote resources, beaconing user activity without any visible indication to the developer. No public exploit has been identified at time of analysis, and the CVSS 4.3 Medium score reflects a limited confidentiality-only impact with no integrity or availability consequence.
JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentials and secrets to anyone with read access to IDE log output. The CWE-532 flaw affects Go developers whose project configurations contain API keys, VCS credentials, or cloud tokens - values the IDE silently captures in plaintext log entries during normal use. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the low CVSS score of 3.5 reflects the limited impact and the requirement for low privilege and user interaction.
Stored XSS in JetBrains YouTrack before 2026.2.17394 allows low-privileged authenticated users to inject malicious scripts into article titles, which are then rendered unsanitized within digest emails delivered to other users. When a recipient opens the digest email in an HTML-capable client and interacts with the affected content, the injected script executes in their browser context, enabling session token or credential theft. No public exploit or active exploitation has been identified; the CVSS score of 3.5 (Low) reflects the constrained impact due to required authentication, mandatory user interaction, and limited confidentiality-only impact.
Stored cross-site scripting in JetBrains TeamCity before 2026.1.2 lets an unauthenticated attacker persist malicious script through the agent registration flow, which then executes in the browser of any privileged user (e.g. an administrator) who later views the affected agent-management interface. Because agent registration requires no authentication, the entry barrier is minimal, and successful execution in an admin session can lead to session/token theft and pivoting to control of a CI/CD build server. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Stored cross-site scripting in JetBrains TeamCity before 2026.1.2 lets an attacker who controls a build agent persist a malicious script into agent-reported data that executes when a privileged user opens the cloud profile page. Because it fires in the browser session of an operator with access to CI/CD configuration, it can lead to session/token theft and actions performed as the victim. The issue was reported by JetBrains itself; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
CSS injection via Mermaid diagram rendering in JetBrains YouTrack before version 2026.2.17012 permits authenticated low-privilege users to embed malicious CSS into diagram content that executes in the browsers of other users who view the affected page. The CVSS score of 3.5 (Low) reflects the dual gating conditions of required authentication and victim interaction, substantially constraining real-world impact to UI manipulation rather than data exfiltration or code execution. No public exploit code or active exploitation has been identified at time of analysis.
Improper access control in JetBrains YouTrack before version 2026.2.16593 permits authenticated low-privileged users to read saved queries and tags outside their authorized scope. The flaw stems from missing authorization checks (CWE-862), meaning the application fails to verify whether the requesting user holds the required permissions before serving these resources over the network. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the network-accessible nature of the issue means any authenticated user on an exposed YouTrack instance is a potential threat actor.
Excessive user profile data disclosure in JetBrains YouTrack before 2026.2.16593 results from overly permissive default role configuration, allowing any authenticated low-privilege user to read more user profile attributes than intended. The root cause is CWE-276 (Incorrect Default Permissions), where the shipped default role grants broader read access to user directory data than the principle of least privilege requires. No public exploit or confirmed active exploitation exists at time of analysis.
Project settings disclosure in JetBrains YouTrack before version 2026.2.16593 allows an authenticated low-privileged user to read project configuration data they are not authorized to access via the MCP (Model Context Protocol) integration. The root cause is a missing authorization check (CWE-862) on MCP-exposed endpoints, meaning the server returns project settings without validating the requesting user's project-level permissions. No public exploit has been identified at time of analysis, no KEV listing exists, and a vendor-released patch is available.
Improper access control in JetBrains YouTrack before 2026.1.13570 permits any authenticated low-privileged user to enumerate restricted issues and articles through the Planning Canvas feature, exposing confidential project data they are not authorized to view. Rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), the flaw allows user-controlled identifiers to bypass access restrictions without proper authorization checks. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Improper access control in JetBrains YouTrack before version 2026.1.13570 permits any low-privileged authenticated user to modify service accounts, an administrative operation that should be restricted to privileged roles. Rooted in CWE-862 (Missing Authorization), the flaw is exploitable over the network with low complexity, requiring no user interaction - meaning any valid account holder on an exposed instance can tamper with service account configurations. No public exploit or CISA KEV listing has been identified at time of analysis, but the integrity impact is rated high given the sensitivity of service account access in YouTrack deployments.
Stored XSS in JetBrains PyCharm's Jupyter notebook Markdown cell renderer allows a remote, unauthenticated attacker to execute arbitrary JavaScript in the context of a victim's PyCharm session by delivering a crafted notebook file. All PyCharm versions prior to 2025.3.4 are affected. The vulnerability carries no KEV listing and no public exploit has been identified at time of analysis, though the low attack complexity and lack of required privileges make opportunistic abuse via shared or repository-hosted notebooks plausible.
XXE injection in IntelliJ IDEA's UI Designer form parser exposes local file contents to disclosure when a developer opens a maliciously crafted `.form` file in any version prior to 2026.1. The vulnerability arises because the XML parser fails to restrict external entity references (CWE-611), enabling an attacker-supplied document to read arbitrary local files accessible to the IDE process. No public exploit or CISA KEV listing exists at time of analysis; the low CVSS score of 3.3 reflects the local attack vector and requirement for user interaction, limiting real-world impact compared to network-exploitable XXE.
Stored cross-site scripting in JetBrains TeamCity's SAML login page allows a high-privileged attacker to inject persistent malicious scripts that execute in victims' browsers upon visiting the login page. All TeamCity versions prior to 2026.1 are affected. The changed scope (S:C) in the CVSS vector indicates the injected payload can affect browser sessions beyond the immediate component, though confidentiality impact is rated low and no integrity or availability loss is assessed. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Open redirect in JetBrains TeamCity's SAML authentication plugin (all versions before 2026.1) allows a remote unauthenticated attacker to redirect authenticated users to arbitrary external URLs during the SAML login flow. The vulnerability carries a CVSS 3.1 score of 3.1 (Low), reflecting high attack complexity and mandatory user interaction - limiting realistic exploitation to targeted phishing scenarios against TeamCity users leveraging SAML SSO. No public exploit code exists and no active exploitation has been confirmed.
Credential exposure in JetBrains TeamCity before version 2026.1 allows authenticated remote attackers to retrieve sensitive secrets via JVM thread name inspection. The root cause (CWE-522 - Insufficiently Protected Credentials) is TeamCity embedding credential values directly into thread names, which surfaces in thread dumps, monitoring interfaces, and diagnostic tooling accessible to low-privileged users. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, but the high confidentiality impact (CVSS C:H) makes it a significant credential theft vector in enterprise CI/CD environments where TeamCity routinely holds access tokens to source repositories, cloud infrastructure, and deployment targets.
Credential parameter exposure in JetBrains TeamCity before version 2026.1 allows authenticated low-privilege users to access sensitive credential values through the parameter autocompletion feature. Rooted in CWE-862 (Missing Authorization), the autocompletion endpoint fails to enforce proper access controls before surfacing credential parameters, potentially leaking secrets such as passwords, tokens, or API keys stored in build configurations. No public exploit code exists and this vulnerability is not listed in CISA KEV, but the low attack complexity and network accessibility make it a meaningful lateral movement or privilege escalation risk in multi-tenant CI/CD environments.
Sensitive data exposure in JetBrains TeamCity before 2025.11.2 allows authenticated low-privileged users to read confidential values stored in default build agent parameters. The root cause (CWE-526) indicates that sensitive information - such as API keys, tokens, or credentials - is passed or stored through agent environment/configuration parameters without adequate access restrictions. With a CVSS score of 4.3 and no public exploit or KEV listing, this represents a moderate-priority information disclosure risk, most dangerous in environments where agent parameters are used to propagate secrets across pipelines.
Insufficient username validation in the SAML plugin of JetBrains TeamCity before 2026.1 allows unauthenticated remote attackers to bypass authentication controls and gain unauthorized access to CI/CD resources. The flaw (CWE-863, Incorrect Authorization) permits manipulation of the username field within SAML assertions, potentially enabling impersonation of legitimate users and unauthorized read/write access to build configurations and pipeline data. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Reflected cross-site scripting on the TeamCity repository download page allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL. The Changed scope (S:C) in the CVSS vector indicates the payload can escape the vulnerable component and affect the victim's broader browser session, enabling session token theft, credential harvesting, or malicious redirects against TeamCity users. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Information disclosure in JetBrains YouTrack before version 2026.1.13162 allows authenticated low-privilege users to access sensitive user and group membership data they are not authorized to view. Rooted in CWE-863 (Incorrect Authorization), the flaw exists on the Users and Groups administrative pages, where authorization checks are insufficiently enforced for authenticated sessions. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the low access complexity means any authenticated attacker can reliably reproduce the condition.
Stored cross-site scripting in JetBrains YouTrack versions prior to 2026.1.13162 allows an authenticated project-level user to inject persistent JavaScript into project notification templates, which executes in the browsers of other users who receive or view those notifications. The scope-changed CVSS 8.7 reflects that injected scripts can pivot beyond the vulnerable component to compromise the sessions and data of higher-privileged recipients. No public exploit identified at time of analysis and no KEV listing, but the issue was disclosed and patched directly by the vendor.
JetBrains Datalore versions before 2026.1 contain a session hijacking vulnerability (CVE-2026-32745) caused by missing secure attribute configuration on session cookies, allowing attackers on the same network to intercept and reuse session tokens. The vulnerability affects all Datalore versions prior to 2026.1 and requires adjacent network access combined with user interaction; while the CVSS score is moderate (6.3), the impact is high for confidentiality and enables unauthorized account access.
JetBrains Hub versions prior to 2026.1 contain an authentication bypass vulnerability where attackers with valid credentials can gain unauthorized access to accounts through sign-in mismatches when SSO is disabled and two-factor authentication is not configured. An authenticated attacker can exploit this to achieve both confidentiality and integrity violations. No patch is currently available for this vulnerability.
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk [CVSS 2.3 LOW]
Insufficient authorization checks in JetBrains TeamCity before version 2025.11.3 permit project developers to modify build configuration parameters without proper access controls. An authenticated attacker with developer privileges could inject malicious parameters into build configurations, potentially altering build behavior or exposing sensitive information. No patch is currently available for this vulnerability.
Teamcity versions up to 2025.11.3 is affected by url redirection to untrusted site (open redirect) (CVSS 4.3).
Youtrack versions up to 2025.3.119033 is affected by insertion of sensitive information into log file (CVSS 6.5).
Stored cross-site scripting in JetBrains TeamCity server builds prior to 2025.11 allows an authenticated user with low-level privileges to plant a malicious script payload in a session attribute, which then executes in the browser of another user who renders the affected content. Exploitation is not fully unauthenticated: it requires a valid low-privilege TeamCity account to stage the payload (PR:L) plus victim interaction (UI:R), and the resulting impact is limited to script execution inside the victim's authenticated browser context with low confidentiality and integrity effects and no availability impact (CVSS 5.4, CWE-79). No public exploit code has been identified at time of analysis, and EPSS places exploitation likelihood at roughly 0.5% (40th percentile), making this a moderate, not top-priority, issue.
Command injection in the GitHub Copilot plugin for JetBrains IDEs lets a local attacker with low-level privileges execute arbitrary code on a developer's workstation; because the flaw is triggered through the plugin's local command path, it cannot be reached remotely over the network (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High). Exploitation requires the Copilot plugin to be installed in a JetBrains IDE and the attacker to already have local access to the host, where crafted input passed into the vulnerable command handling is executed without further user interaction. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is low at 0.36% (28th percentile), so this is a credible but not emergency-grade issue that primarily threatens developer endpoints rather than web-based or cloud Copilot usage.
In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local privilege escalation in JetBrains ReSharper, Rider, and dotTrace before 2025.2.5 lets an attacker who already holds a low-privileged local account win a time-of-check-to-time-of-use race condition against a higher-privileged operation and gain that operation's privileges on the same host. The issue is rated 7.0 (AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H), meaning it is authenticated-local and non-deterministic - typically requiring repeated attempts - and no public exploit identified at time of analysis (EPSS 0.00%, not in CISA KEV). Realistic exposure is limited to multi-user or developer endpoints where the tool or its elevated helper, installer, or updater is present.
In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.
HTML injection in JetBrains YouTrack's VCS command failure notifications (before 2026.2.19422) allows an authenticated attacker with high privileges to inject arbitrary HTML into notifications, potentially leading to content spoofing or script execution, but a victim must view the crafted notification. The vulnerability requires high attack complexity, and no public exploit code or active exploitation has been identified. Despite the low CVSS score of 2.0, it is a genuine XSS flaw that should be remediated by upgrading to version 2026.2.19422 or later.
JetBrains YouTrack before 2026.2.19197 fails to enforce read permissions when creating a project from a custom template, allowing an authenticated low-privileged user to read template data they are not authorized to access. This missing authorization flaw (CWE-862) has a low confidentiality impact (CVSS 3.1) and requires high attack complexity, a valid account, and the existence of an unreadable custom template; no public exploit code has been identified. The vendor has released a patch in version 2026.2.19197.
Credential disclosure in JetBrains YouTrack before 2026.2.19197 lets an authenticated user who can edit an existing integration's configuration URL redirect the integration's stored credentials to an attacker-controlled endpoint by simply changing that URL. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity, low-privilege flaw with high confidentiality impact and no integrity or availability effect, consistent with a credential-theft bug rather than code execution or full takeover; no public exploit identified at time of analysis, and no exploitation status is confirmed by CISA KEV for this CVE.
Improper authorization in JetBrains YouTrack before 2026.2.19197 allows an authenticated user with restricted project permissions to edit and hide other users' comments. The flaw is an incorrect authorization check (CWE-863) that yields only integrity impact - no data disclosure or service disruption - and exploitation requires an existing YouTrack account. No public exploit code has been identified at the time of analysis, and a vendor patch is available in version 2026.2.19197.
Stored cross-site scripting in JetBrains YouTrack before 2026.2.19197 allows an attacker with privileges to create or modify workflows-effectively a project administrator or workflow author-to store script content that is later rendered in a workflow error notification toast. The victim must trigger the affected workflow error path (UI:R) for the payload to execute in their authenticated YouTrack browser session; this is not a remote unauthenticated attack against default configurations, and the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N keeps confidentiality and integrity impact low. Vendor-released patch 2026.2.19197 is available, and no public exploit identified at time of analysis.
Denial of service in JetBrains YouTrack affects all builds before 2026.2.19197, where a project administrator can craft a notification template that drives uncontrolled resource consumption on the server. The requirement for an authenticated account holding project Admin rights (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5) confines realistic exposure to malicious or compromised administrators rather than ordinary or anonymous users, and the impact is limited to availability with no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, though JetBrains has shipped a vendor patch in 2026.2.19197 and the flaw is tracked in ENISA EUVD as EUVD-2026-90018.
Missing authorization in the notification template preview of JetBrains YouTrack (versions before 2026.2.19197) allows an authenticated attacker who holds Project Administrator rights to read issues that are otherwise restricted from them. The flaw is network-exploitable with low attack complexity and no victim interaction, but the CVSS vector (PR:H) means the attacker must already be a privileged, semi-trusted insider within a project, which is why the score stays at 4.9 (Medium). There is no public exploit identified at time of analysis and no KEV listing; the vendor has released a fix in YouTrack 2026.2.19197 (tracked as EUVD-2026-90016).
JetBrains YouTrack before 2026.2.19197 contains a broken access control vulnerability (CWE-862) that allows authenticated users with low privileges to read information from projects they are not authorized to access via several endpoints lacking authorization checks. The flaw requires a valid account and impacts only confidentiality; no data modification or privilege escalation is possible. It is rated low severity (CVSS 2.7) and no public exploit has been identified at time of analysis.
JetBrains YouTrack before 2026.2.19197 can disclose integration credentials to an authenticated user who holds the low-level Admin Read permission through import configurations, allowing that user to view secrets that should remain restricted. The flaw is CWE-863 incorrect authorization with a vendor CVSS score of 3.3 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N), and the independent assessment further narrows impact to confidentiality only (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N). Exploitation requires high privileges, high attack complexity, and a vulnerable instance that has integrations with stored credentials; no public exploit identified at time of analysis, and vendor-released patch 2026.2.19197 is available, so real-world urgency is low.
Authorization bypass in JetBrains YouTrack before 2026.2.19197 lets an authenticated low-privileged user circumvent a helpdesk project's Authorized Reporters allowlist and file reports that the configuration was meant to block. The issue is network-reachable with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3), but its impact is limited to integrity - unauthorized report submission - with no confidentiality or availability effect. It applies only to instances where a helpdesk project has actually been configured with an Authorized Reporters restriction, and the CVSS PR:L metric confirms the attacker must already hold a valid low-privileged account rather than being fully anonymous; no public exploit identified at time of analysis.
Authenticated project administrators in JetBrains YouTrack before 2026.2.19197 can read comments from projects they do not administer by exploiting a notification-template authorization bypass. This network-exploitable flaw requires an account with project-administrator privileges and no user interaction, resulting in a high-confidentiality impact with a scope change (CVSS 7.7). No public exploit or active exploitation has been identified at time of analysis.
Denial of service in JetBrains YouTrack allows an unauthenticated remote attacker to exhaust server CPU and request-handling threads by sending crafted email content that triggers catastrophic regular-expression backtracking in mailbox mail-rule filters, affecting all releases up to 2026.2.19197. The impact is limited to availability (CVSS:C:N/I:N/A:H, base score 5.9); there is no confidentiality or integrity effect. Exposure is contingent on a non-default, operator-dependent configuration - the mailbox integration must be enabled with regex-based mail-rule filters - and there is no public exploit identified at time of analysis, so this is a genuine but modest-priority availability issue rather than a broadly exploitable one.
Authenticated users of JetBrains Hub can send arbitrary emails from the server's trusted address due to a missing authorization check in versions before 2026.2.52366. The flaw requires a valid low-privilege Hub account (PR:L) and network reachability to the instance, but no user interaction; it allows spoofing outbound email, which can damage trust in the organization's sender identity. No public exploit has been identified at time of analysis, and the vendor has released a patch.
JetBrains Rider versions before 2026.2.1 allow the bundled AI Assistant to silently auto-update third-party skills - downloaded plugin-style capability packages that extend the assistant - without prompting the user or verifying the integrity of the update, enabling an attacker who controls or compromises a skill source the developer already trusts to push malicious skill content into the IDE. Exploitation is constrained: it requires the victim to run an affected Rider build with AI Assistant enabled and at least one third-party skill installed from an attacker-influenceable source, which is why the vector carries high attack complexity (AC:H) and only low confidentiality and integrity impact with no availability impact. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) applies; a vendor patch is available in Rider 2026.2.1.
Stored SMTP credentials in JetBrains YouTrack can be exposed to an already-authenticated administrator by changing the configured SMTP server host, affecting versions before 2026.2.18991. The issue is rated CVSS 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), so confidentiality impact is limited and exploitation requires high-privilege access - in practice an insider or an attacker who has already compromised an admin account in an instance where outbound email/notification delivery is configured. A vendor patch is available, and no public exploit has been identified at time of analysis.
Stored HTML injection in JetBrains YouTrack before 2026.2.18991 allows unauthenticated remote attackers to plant attacker-controlled markup into the application through the User-Agent HTTP header, which is subsequently stored and rendered to other users without adequate output encoding. Impact is limited to Low confidentiality with a scope change and no integrity or availability effect; exploitation depends on user interaction (UI:R), as a user - typically an operator reviewing stored request or user-agent data - must open the affected page for the injected HTML to render. There is no public exploit identified at time of analysis, and the vendor has released a fix in version 2026.2.18991.
Improper authorization in JetBrains YouTrack allows an authenticated, low-privileged user to change a knowledge-base article's visibility settings even though that account does not hold the article update permission. Only instances running versions before 2026.2.18991 are affected, and the impact is limited to low confidentiality and low integrity with no availability impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV); the vendor has released a fixed build, making this a modest-severity broken access control issue rather than a top-tier priority.
Stale authentication material tied to JetBrains YouTrack's mailbox integration continues to be accepted after a user's password reset in versions prior to 2026.2.18991, letting an actor who already holds the pre-reset credentials keep authenticating through that path when the reset should have invalidated them. The flaw is limited to deployments that use the mailbox integration feature and to accounts that have actually undergone a password reset; the impact is integrity-only (no confidentiality or availability effect), and the assessed complexity is higher than the base 5.3 vector implies because a preceding reset plus possession of the stale credentials are both required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the vendor has released a fix.
Improper access control in JetBrains YouTrack before 2026.2.18991 lets an authenticated user who has only view-only permission on a Gantt chart perform edit operations that the access model should block. The flaw is network-reachable but requires a valid YouTrack account (PR:L), has no user-interaction component, and is confined to low-severity integrity impact on scheduling/Gantt data with no confidentiality or availability effect (CVSS 4.3, CWE-863). There is no confirmed active exploitation (CISA KEV not listed) and no public exploit identified at time of analysis; the vendor has released a fixed build in 2026.2.18991.
Read-only users in JetBrains YouTrack can read project settings they are not entitled to see because the application fails to enforce an authorization check on that data path in all versions before 2026.2.18991. Exploitation requires a valid, authenticated YouTrack account at the read-only privilege level (CVSS vector PR:L), and the resulting impact is limited to disclosure of project settings configuration data - no modification of data, no privilege escalation, and no impact on availability. Scoring is low at CVSS 4.3, there is no CISA KEV listing and no public exploit code identified at time of analysis, and JetBrains has shipped a fixed build (2026.2.18991), so this is a low-priority information-disclosure issue that should be handled through normal patch cadence.
Server-side request forgery in JetBrains YouTrack before 2026.2.18991 lets an authenticated user coerce the server-side PDF export renderer into making outbound requests to attacker-influenced URLs by storing crafted XHTML content that is rendered when that content is exported to PDF. The assessed impact is confidentiality-only (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and the attack requires a valid YouTrack account plus write access to a stored field that reaches the PDF renderer; no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1, where the IDE injects a pprof HTTP server into profiled processes without any access control. An attacker with network connectivity to the developer workstation during an active profiling session can retrieve heap dumps, goroutine stacks, CPU traces, and in-memory data structures that may contain credentials, tokens, or sensitive application state. No public exploit code exists and this is not listed in CISA KEV; however, the attack requires only standard HTTP requests against an unauthenticated endpoint, making it trivially simple when the prerequisite conditions are met.
IntelliJ IDEA before version 2026.2.2 leaks project metadata to JetBrains Marketplace due to a missing project-trust check, exposing potentially sensitive project information without developer consent. The flaw requires local access and user interaction - specifically, a developer must open an untrusted project for the metadata transmission to occur. No public exploit code exists and no active exploitation has been identified; the impact is limited to a low-severity confidentiality breach (CVSS 3.3).
Server-Side Request Forgery (SSRF) in JetBrains IntelliJ IDEA before version 2026.2.2 allows an attacker to probe internal network resources by embedding a malicious Kubernetes spec-source URL inside a crafted project file. When a developer opens the untrusted project, the IDE automatically fetches the attacker-controlled URL, causing outbound requests to arbitrary hosts reachable from the developer's machine. Impact is limited to partial confidentiality loss (C:L) - internal network topology or service responses may be disclosed - with no integrity or availability consequences. No public exploit code is identified and the vulnerability is not listed in CISA KEV at time of analysis.
Terminal command input written to idea.log in JetBrains IntelliJ IDEA before 2026.2.2 exposes sensitive command-line strings to any local party that can read the IDE's diagnostic log. Classified as CWE-532 (Insertion of Sensitive Information into Log File), the flaw means that developers who type passwords, API keys, or tokens as command-line arguments in IntelliJ's integrated terminal inadvertently persist those secrets on disk in a plaintext log file. No public exploit has been identified at time of analysis, and the vendor-assigned CVSS score of 2.8 accurately reflects the constrained local-only, user-interaction-dependent attack surface.
Privilege escalation in JetBrains YouTrack before version 2026.1.14047 allows an authenticated user holding project update permissions to grant themselves the Project Admin role without proper authorization. The vulnerability stems from a missing escalation check (CWE-266: Incorrect Privilege Assignment) in the project permissions workflow, enabling a project contributor to cross a privilege boundary and assume administrative control over a project. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is known at time of analysis.
Authenticated users in JetBrains YouTrack before 2026.1.14047 can enumerate all group names via predefined search fields, bypassing group visibility permissions enforced elsewhere in the product. The flaw (CWE-862 Missing Authorization) means the access-control check applied to group visibility was not consistently applied to the predefined search field code path, leaking organizational structure to any logged-in user. No active exploitation has been identified and no public exploit code exists; CVSS 4.3 reflects the limited confidentiality impact.
Credential exfiltration in JetBrains YouTrack before 2026.2.18769 allows a project administrator to redirect stored mailbox credentials to an attacker-controlled server by modifying the mailbox host setting without triggering re-authentication. The missing re-authentication gate means any project admin who has been compromised, is malicious, or has temporarily elevated access can silently capture email account credentials (username and password) already stored in YouTrack. No public exploit has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Missing authorization (CWE-862) in JetBrains YouTrack before 2026.2.18769 allows any low-privileged authenticated user to read the email addresses of Helpdesk authorized reporters, who are external contacts registered to submit issues. The flaw bypasses the intended access control on the Helpdesk reporter roster, exposing personally identifiable contact data to users who should have no visibility into it. No public exploit is identified at time of analysis, and the vulnerability has been patched by JetBrains in version 2026.2.18769.
Missing server-side permission checks in JetBrains YouTrack before 2026.2.18687 allow any authenticated user to create knowledge base articles inside projects they are not authorized to access. The flaw is rooted in CWE-862 (Missing Authorization), where the article-creation endpoint omits the necessary access control validation against the caller's project permissions. No public exploit or active exploitation has been identified; the CVSS PR:L metric confirms exploitation is limited to users who already hold a valid YouTrack account.
Improper authorization in JetBrains YouTrack before 2026.2.18634 allows authenticated read-only users to create and modify whiteboard cards, exceeding their intended permissions. The flaw (CWE-863) bypasses YouTrack's role-based access controls for the whiteboard feature, enabling low-privileged users to perform write operations they should be denied. No public exploit code or active exploitation has been identified, and a vendor-confirmed fix is available. EPSS data was not provided; real-world risk is moderate given the authentication prerequisite.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows a high-privileged attacker to inject malicious scripts by uploading crafted project or organization icon files. When other authenticated users subsequently view the affected project or organization page, the stored payload executes in their browser context, enabling session data exposure or unauthorized in-application actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Insufficient permission checks on the app import endpoint in JetBrains YouTrack before version 2026.2.18634 allow an authenticated low-privileged user to overwrite bundled applications, achieving high-integrity impact across all unpatched deployments. The flaw is rooted in CWE-863 (Incorrect Authorization), meaning the server fails to validate that the requesting account holds sufficient privileges for a destructive write operation against pre-installed components. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in JetBrains YouTrack before 2026.2.18634 allows authenticated low-privileged users to enumerate and read private issues and starred folder contents belonging to other users across organizational boundaries by manipulating user profile API identifiers. The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/C:H) reflects straightforward network exploitation requiring only a valid session. No public exploit or KEV listing is present, but the low attack complexity and high confidentiality impact make this a meaningful data-exposure risk in multi-tenant or multi-organization YouTrack deployments.
Insecure Direct Object Reference in JetBrains YouTrack before version 2026.2.18634 permits authenticated users to access other users' private saved searches through the watchRules and issueListConfig API endpoints. The endpoints fail to enforce authorization checks on user-controlled object identifiers, allowing horizontal privilege escalation without elevated permissions. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Authorization bypass in JetBrains YouTrack's whiteboard feature allows authenticated read-only whiteboard users to modify canvas content they should only be able to view, by sending a crafted WebSocket message. Affected versions are all YouTrack releases before 2026.2.18634. The vulnerability stems from CWE-863 (Incorrect Authorization) - the server-side WebSocket handler fails to enforce the read-only permission boundary, accepting write operations from users who lack write privileges. No public exploit or active exploitation has been identified.
The generic VCS webhook handler in JetBrains YouTrack before 2026.2.18634 fails open when no webhook secret is configured, allowing unauthenticated remote callers to trigger webhook processing without any valid credential check. This CWE-306 flaw means that deployments where the webhook secret field is intentionally or inadvertently left blank accept all inbound webhook payloads as legitimate, bypassing the shared-secret verification mechanism. No public exploit code has been identified and the vulnerability is not in CISA KEV; the low CVSS score of 3.7 with AC:H accurately reflects that exploitation is constrained to misconfigured instances.
IP spoofing via forged HTTP headers in JetBrains YouTrack before 2026.2.18634 allows unauthenticated remote attackers to bypass Bitbucket webhook source validation, causing YouTrack to process attacker-crafted webhook payloads as if they originated from a legitimate Bitbucket server. The root cause is CWE-291 - reliance on IP address for authentication - specifically trusting client-controlled headers such as X-Forwarded-For to gate webhook acceptance. No public exploit has been identified at time of analysis, and JetBrains has released a patched build.
Stored XSS in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privilege users to inject AngularJS template expressions through issue assignee name fields, which are then evaluated as client-side JavaScript in the browsers of any user who views the affected issue or project board. The attack persists server-side, meaning every subsequent viewer triggers execution without further attacker interaction. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privileged users to inject persistent malicious scripts through custom field values displayed on Agile board cards. When a victim with an active YouTrack session views the affected Agile board, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code has been identified at time of analysis, and JetBrains has released a patched version.
Signed URL reuse in JetBrains YouTrack before 2026.2.18634 permits authenticated users to access restricted project icons they are not authorized to view. The flaw arises because signed URLs generated for project icon assets are not properly scoped or invalidated, allowing the same URL to be reused beyond its intended access context. No public exploit code has been identified and the vendor has issued a patch, making this a low-urgency but straightforward authorization control deficiency in a widely used issue tracker.
Cross-site scripting in JetBrains PyCharm's Quick Documentation rendering feature (before version 2026.2.1) enables code execution within the IDE process when a developer inspects documentation for a symbol from a maliciously crafted source. Attackers - including supply-chain adversaries embedding malicious HTML or JavaScript into Python package docstrings - can achieve code execution in PyCharm's local process context once the victim triggers Quick Documentation on an affected symbol. No public exploit has been identified at time of analysis, and JetBrains has released a fix in version 2026.2.1.
XML External Entity injection in JetBrains IntelliJ IDEA's Eclipse settings importer exposes sensitive local files on developer workstations running versions prior to 2026.2.1. The flaw (CWE-611) is triggered when a user imports a maliciously crafted Eclipse settings XML file, allowing an attacker to read arbitrary files accessible to the IDE process. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Git credentials are recorded in plaintext to IntelliJ IDEA's local IDE log file in all versions before 2026.1.5, exposing usernames, passwords, and tokens to any entity with read access to those log files. This CWE-532 information disclosure flaw affects the IDE's built-in Git integration subsystem and carries a high confidentiality impact (C:H in CVSS) because exposed credentials can grant full access to remote source code repositories. No public exploit has been identified at time of analysis, and CISA KEV lists no active exploitation.
Local file disclosure in JetBrains IntelliJ IDEA before 2026.2.1 is possible through an XXE injection in the Hadoop ResourceManager integration component. When a developer opens or processes a maliciously crafted XML-based project or configuration file, the unsanitized XML parser resolves external entity references and leaks arbitrary local files - including SSH keys, credentials, and application secrets - to the attacker. The CVSS vector (AV:L/UI:R) confines the risk to local or social-engineering attack paths; no public exploit or CISA KEV listing has been identified at time of analysis.
Server-Side Request Forgery in JetBrains IntelliJ IDEA before version 2026.2.1 allows an attacker who supplies a malicious project to cause the IDE's OpenAPI preview proxy to issue HTTP requests to arbitrary internal or external endpoints. The scope change (S:C in CVSS) indicates the proxy can reach resources beyond the local machine, enabling internal network reconnaissance or credential harvesting from metadata services. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the high confidentiality impact and developer-targeting nature elevate practical concern.
Server-Side Request Forgery in JetBrains IntelliJ IDEA before version 2026.2.1 allows network-accessible attackers to coerce the IDE into issuing arbitrary HTTP requests via the DevKit debug listener endpoint, requiring user interaction to trigger. The vulnerability carries a CVSS 5.4 (Medium) score with low confidentiality and integrity impact, and no availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting limited real-world exploitation pressure currently.
Command injection in JetBrains IntelliJ IDEA before 2026.2.1 enables arbitrary command execution through crafted Markdown preview content when a user opens and trusts a malicious project. The flaw (CWE-77) is constrained to trusted projects and requires the victim to interact with the Markdown preview, limiting its practical reach. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor-assigned CVSS score of 3.6 (Low) reflects these mitigating conditions.
Denial-of-service in JetBrains YouTrack before versions 2026.1.13901 and 2026.2.17950 allows authenticated remote attackers to exhaust server resources by submitting crafted type parameters, rendering the service unavailable. The vulnerability stems from uncontrolled resource consumption (CWE-770), where malformed input is not bounded before processing. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized cross-project article disclosure in JetBrains YouTrack allows any authenticated user to read restricted knowledge base articles belonging to projects they are not authorized to access, by exploiting a missing authorization check on the draft creation endpoint. Affected are all YouTrack deployments running versions before 2026.1.13903 and 2026.2.17950. No public exploit or active exploitation has been identified, but the low attack complexity and network-accessible vector make this trivially repeatable by any valid account holder on the instance.
Denial-of-service in JetBrains YouTrack before 2026.2.18177 allows an authenticated low-privileged user to exhaust server resources by uploading a decompression bomb to the import endpoint. The CVSS vector confirms full availability impact (A:H) with no confidentiality or integrity consequences. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, making this a moderate-priority internal threat requiring authenticated access.
Account enumeration in JetBrains YouTrack before version 2026.2.18112 exposes internal user accounts to any authenticated user through insufficient authorization controls on the users search endpoint. The root cause is CWE-862 (Missing Authorization): the endpoint performs no privilege check beyond requiring a valid session, allowing low-privilege users to systematically extract account identifiers across the entire instance. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the straightforward exploitation path makes patching a clear priority.
HTML injection in JetBrains IntelliJ IDEA before version 2026.2 enables silent user activity tracking through maliciously crafted IDE notifications. A remote attacker who can influence notification content - such as through a malicious plugin, crafted project file, or server response reflected as a notification - can inject arbitrary HTML payloads that silently load remote resources, beaconing user activity without any visible indication to the developer. No public exploit has been identified at time of analysis, and the CVSS 4.3 Medium score reflects a limited confidentiality-only impact with no integrity or availability consequence.
JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentials and secrets to anyone with read access to IDE log output. The CWE-532 flaw affects Go developers whose project configurations contain API keys, VCS credentials, or cloud tokens - values the IDE silently captures in plaintext log entries during normal use. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the low CVSS score of 3.5 reflects the limited impact and the requirement for low privilege and user interaction.
Stored XSS in JetBrains YouTrack before 2026.2.17394 allows low-privileged authenticated users to inject malicious scripts into article titles, which are then rendered unsanitized within digest emails delivered to other users. When a recipient opens the digest email in an HTML-capable client and interacts with the affected content, the injected script executes in their browser context, enabling session token or credential theft. No public exploit or active exploitation has been identified; the CVSS score of 3.5 (Low) reflects the constrained impact due to required authentication, mandatory user interaction, and limited confidentiality-only impact.
Stored cross-site scripting in JetBrains TeamCity before 2026.1.2 lets an unauthenticated attacker persist malicious script through the agent registration flow, which then executes in the browser of any privileged user (e.g. an administrator) who later views the affected agent-management interface. Because agent registration requires no authentication, the entry barrier is minimal, and successful execution in an admin session can lead to session/token theft and pivoting to control of a CI/CD build server. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Stored cross-site scripting in JetBrains TeamCity before 2026.1.2 lets an attacker who controls a build agent persist a malicious script into agent-reported data that executes when a privileged user opens the cloud profile page. Because it fires in the browser session of an operator with access to CI/CD configuration, it can lead to session/token theft and actions performed as the victim. The issue was reported by JetBrains itself; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
CSS injection via Mermaid diagram rendering in JetBrains YouTrack before version 2026.2.17012 permits authenticated low-privilege users to embed malicious CSS into diagram content that executes in the browsers of other users who view the affected page. The CVSS score of 3.5 (Low) reflects the dual gating conditions of required authentication and victim interaction, substantially constraining real-world impact to UI manipulation rather than data exfiltration or code execution. No public exploit code or active exploitation has been identified at time of analysis.
Improper access control in JetBrains YouTrack before version 2026.2.16593 permits authenticated low-privileged users to read saved queries and tags outside their authorized scope. The flaw stems from missing authorization checks (CWE-862), meaning the application fails to verify whether the requesting user holds the required permissions before serving these resources over the network. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the network-accessible nature of the issue means any authenticated user on an exposed YouTrack instance is a potential threat actor.
Excessive user profile data disclosure in JetBrains YouTrack before 2026.2.16593 results from overly permissive default role configuration, allowing any authenticated low-privilege user to read more user profile attributes than intended. The root cause is CWE-276 (Incorrect Default Permissions), where the shipped default role grants broader read access to user directory data than the principle of least privilege requires. No public exploit or confirmed active exploitation exists at time of analysis.
Project settings disclosure in JetBrains YouTrack before version 2026.2.16593 allows an authenticated low-privileged user to read project configuration data they are not authorized to access via the MCP (Model Context Protocol) integration. The root cause is a missing authorization check (CWE-862) on MCP-exposed endpoints, meaning the server returns project settings without validating the requesting user's project-level permissions. No public exploit has been identified at time of analysis, no KEV listing exists, and a vendor-released patch is available.
Improper access control in JetBrains YouTrack before 2026.1.13570 permits any authenticated low-privileged user to enumerate restricted issues and articles through the Planning Canvas feature, exposing confidential project data they are not authorized to view. Rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), the flaw allows user-controlled identifiers to bypass access restrictions without proper authorization checks. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Improper access control in JetBrains YouTrack before version 2026.1.13570 permits any low-privileged authenticated user to modify service accounts, an administrative operation that should be restricted to privileged roles. Rooted in CWE-862 (Missing Authorization), the flaw is exploitable over the network with low complexity, requiring no user interaction - meaning any valid account holder on an exposed instance can tamper with service account configurations. No public exploit or CISA KEV listing has been identified at time of analysis, but the integrity impact is rated high given the sensitivity of service account access in YouTrack deployments.
Stored XSS in JetBrains PyCharm's Jupyter notebook Markdown cell renderer allows a remote, unauthenticated attacker to execute arbitrary JavaScript in the context of a victim's PyCharm session by delivering a crafted notebook file. All PyCharm versions prior to 2025.3.4 are affected. The vulnerability carries no KEV listing and no public exploit has been identified at time of analysis, though the low attack complexity and lack of required privileges make opportunistic abuse via shared or repository-hosted notebooks plausible.
XXE injection in IntelliJ IDEA's UI Designer form parser exposes local file contents to disclosure when a developer opens a maliciously crafted `.form` file in any version prior to 2026.1. The vulnerability arises because the XML parser fails to restrict external entity references (CWE-611), enabling an attacker-supplied document to read arbitrary local files accessible to the IDE process. No public exploit or CISA KEV listing exists at time of analysis; the low CVSS score of 3.3 reflects the local attack vector and requirement for user interaction, limiting real-world impact compared to network-exploitable XXE.
Stored cross-site scripting in JetBrains TeamCity's SAML login page allows a high-privileged attacker to inject persistent malicious scripts that execute in victims' browsers upon visiting the login page. All TeamCity versions prior to 2026.1 are affected. The changed scope (S:C) in the CVSS vector indicates the injected payload can affect browser sessions beyond the immediate component, though confidentiality impact is rated low and no integrity or availability loss is assessed. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Open redirect in JetBrains TeamCity's SAML authentication plugin (all versions before 2026.1) allows a remote unauthenticated attacker to redirect authenticated users to arbitrary external URLs during the SAML login flow. The vulnerability carries a CVSS 3.1 score of 3.1 (Low), reflecting high attack complexity and mandatory user interaction - limiting realistic exploitation to targeted phishing scenarios against TeamCity users leveraging SAML SSO. No public exploit code exists and no active exploitation has been confirmed.
Credential exposure in JetBrains TeamCity before version 2026.1 allows authenticated remote attackers to retrieve sensitive secrets via JVM thread name inspection. The root cause (CWE-522 - Insufficiently Protected Credentials) is TeamCity embedding credential values directly into thread names, which surfaces in thread dumps, monitoring interfaces, and diagnostic tooling accessible to low-privileged users. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, but the high confidentiality impact (CVSS C:H) makes it a significant credential theft vector in enterprise CI/CD environments where TeamCity routinely holds access tokens to source repositories, cloud infrastructure, and deployment targets.
Credential parameter exposure in JetBrains TeamCity before version 2026.1 allows authenticated low-privilege users to access sensitive credential values through the parameter autocompletion feature. Rooted in CWE-862 (Missing Authorization), the autocompletion endpoint fails to enforce proper access controls before surfacing credential parameters, potentially leaking secrets such as passwords, tokens, or API keys stored in build configurations. No public exploit code exists and this vulnerability is not listed in CISA KEV, but the low attack complexity and network accessibility make it a meaningful lateral movement or privilege escalation risk in multi-tenant CI/CD environments.
Sensitive data exposure in JetBrains TeamCity before 2025.11.2 allows authenticated low-privileged users to read confidential values stored in default build agent parameters. The root cause (CWE-526) indicates that sensitive information - such as API keys, tokens, or credentials - is passed or stored through agent environment/configuration parameters without adequate access restrictions. With a CVSS score of 4.3 and no public exploit or KEV listing, this represents a moderate-priority information disclosure risk, most dangerous in environments where agent parameters are used to propagate secrets across pipelines.
Insufficient username validation in the SAML plugin of JetBrains TeamCity before 2026.1 allows unauthenticated remote attackers to bypass authentication controls and gain unauthorized access to CI/CD resources. The flaw (CWE-863, Incorrect Authorization) permits manipulation of the username field within SAML assertions, potentially enabling impersonation of legitimate users and unauthorized read/write access to build configurations and pipeline data. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Reflected cross-site scripting on the TeamCity repository download page allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL. The Changed scope (S:C) in the CVSS vector indicates the payload can escape the vulnerable component and affect the victim's broader browser session, enabling session token theft, credential harvesting, or malicious redirects against TeamCity users. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Information disclosure in JetBrains YouTrack before version 2026.1.13162 allows authenticated low-privilege users to access sensitive user and group membership data they are not authorized to view. Rooted in CWE-863 (Incorrect Authorization), the flaw exists on the Users and Groups administrative pages, where authorization checks are insufficiently enforced for authenticated sessions. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the low access complexity means any authenticated attacker can reliably reproduce the condition.
Stored cross-site scripting in JetBrains YouTrack versions prior to 2026.1.13162 allows an authenticated project-level user to inject persistent JavaScript into project notification templates, which executes in the browsers of other users who receive or view those notifications. The scope-changed CVSS 8.7 reflects that injected scripts can pivot beyond the vulnerable component to compromise the sessions and data of higher-privileged recipients. No public exploit identified at time of analysis and no KEV listing, but the issue was disclosed and patched directly by the vendor.
JetBrains Datalore versions before 2026.1 contain a session hijacking vulnerability (CVE-2026-32745) caused by missing secure attribute configuration on session cookies, allowing attackers on the same network to intercept and reuse session tokens. The vulnerability affects all Datalore versions prior to 2026.1 and requires adjacent network access combined with user interaction; while the CVSS score is moderate (6.3), the impact is high for confidentiality and enables unauthorized account access.
JetBrains Hub versions prior to 2026.1 contain an authentication bypass vulnerability where attackers with valid credentials can gain unauthorized access to accounts through sign-in mismatches when SSO is disabled and two-factor authentication is not configured. An authenticated attacker can exploit this to achieve both confidentiality and integrity violations. No patch is currently available for this vulnerability.
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk [CVSS 2.3 LOW]
Insufficient authorization checks in JetBrains TeamCity before version 2025.11.3 permit project developers to modify build configuration parameters without proper access controls. An authenticated attacker with developer privileges could inject malicious parameters into build configurations, potentially altering build behavior or exposing sensitive information. No patch is currently available for this vulnerability.
Teamcity versions up to 2025.11.3 is affected by url redirection to untrusted site (open redirect) (CVSS 4.3).
Youtrack versions up to 2025.3.119033 is affected by insertion of sensitive information into log file (CVSS 6.5).
Stored cross-site scripting in JetBrains TeamCity server builds prior to 2025.11 allows an authenticated user with low-level privileges to plant a malicious script payload in a session attribute, which then executes in the browser of another user who renders the affected content. Exploitation is not fully unauthenticated: it requires a valid low-privilege TeamCity account to stage the payload (PR:L) plus victim interaction (UI:R), and the resulting impact is limited to script execution inside the victim's authenticated browser context with low confidentiality and integrity effects and no availability impact (CVSS 5.4, CWE-79). No public exploit code has been identified at time of analysis, and EPSS places exploitation likelihood at roughly 0.5% (40th percentile), making this a moderate, not top-priority, issue.
Command injection in the GitHub Copilot plugin for JetBrains IDEs lets a local attacker with low-level privileges execute arbitrary code on a developer's workstation; because the flaw is triggered through the plugin's local command path, it cannot be reached remotely over the network (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High). Exploitation requires the Copilot plugin to be installed in a JetBrains IDE and the attacker to already have local access to the host, where crafted input passed into the vulnerable command handling is executed without further user interaction. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is low at 0.36% (28th percentile), so this is a credible but not emergency-grade issue that primarily threatens developer endpoints rather than web-based or cloud Copilot usage.
In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local privilege escalation in JetBrains ReSharper, Rider, and dotTrace before 2025.2.5 lets an attacker who already holds a low-privileged local account win a time-of-check-to-time-of-use race condition against a higher-privileged operation and gain that operation's privileges on the same host. The issue is rated 7.0 (AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H), meaning it is authenticated-local and non-deterministic - typically requiring repeated attempts - and no public exploit identified at time of analysis (EPSS 0.00%, not in CISA KEV). Realistic exposure is limited to multi-user or developer endpoints where the tool or its elevated helper, installer, or updater is present.
In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.