Youtrack
Monthly
Stored XSS in JetBrains YouTrack before 2026.2.19422 allows an authenticated user with content-creation rights to inject malicious Mermaid or LaTeX markup that executes in the browser of any user who views the affected issue, comment, or similar content. The vendor CVSS is 8.1, but the independent assessment lowers this to CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting required authentication (unless anonymous/guest issue reporting is enabled), victim interaction, and low confidentiality/integrity impact; signals lean toward moderate real-world priority. No public exploit code or CISA KEV active exploitation was identified at time of analysis.
Privilege escalation in JetBrains YouTrack lets an authenticated holder of an already-high-privilege (non-admin) account raise their effective permissions by abusing the user group links functionality, where a required authorization check is missing (CWE-862). All YouTrack releases before 2026.2.19422 are affected, and the issue is scored CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact once triggered, requiring no user interaction. The PR:H prerequisite meaningfully bounds exposure - anonymous or fully unprivileged users cannot exploit it - and there is no public exploit identified at time of analysis, making this a real but gated finding rather than an urgent fire-drill.
Broken access control in JetBrains YouTrack before 2026.2.19422 allows any authenticated user to add themselves to a project team, gaining unauthorized access to restricted issues. This CVE-2026-103488 has a CVSS score of 7.1 and requires a low-privileged account (PR:L); no public exploit code has been identified at time of analysis. The flaw is classified as CWE-863 (Incorrect Authorization) and affects all YouTrack versions prior to the fixed release 2026.2.19422.
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notification signature, allowing an attacker who has captured a legitimate signature to authenticate as the associated account. Every YouTrack instance running an earlier build is affected (CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*), and the root cause is an incorrect-authorization flaw (CWE-863) rather than memory corruption. The practical barrier is signature acquisition: our assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (high, not the input's 9.8 critical) because exploitation depends on capturing or observing a victim's notification signature rather than a blind unauthenticated request against a default install. No public exploit code and no confirmed active exploitation have been identified (EPSS 0.33%, 24th percentile; CISA SSVC lists Exploitation: none), and JetBrains has released a fix in 2026.2.19197.
Incorrect authorization in JetBrains YouTrack before version 2026.2.19197 allows guest users to strip a workflow action's visibility restriction and then execute that action, altering workflow behavior on the instance. The flaw is network-reachable and rated CVSS 7.5 with a PR:N vector, though practical exposure depends on guest access being enabled on the target instance - a configuration in which the guest context supplies the effective precondition; disabling guest access removes the attack surface entirely. Impact is limited to integrity of workflow actions (no confidentiality or availability effect), there is no public exploit identified at time of analysis, EPSS is low (0.29%, roughly 19th percentile), CISA SSVC records exploitation status as none, and the vendor has released a patch in 2026.2.19197.
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an authorisation bypass in the scripts debugger, a CVSS 3.1 9.8 flaw (PR:N/UI:N, scope unchanged, confidentiality/integrity/availability all High). Real-world urgency is low despite the score: EPSS is 0.36% (28th percentile), no public exploit code has been identified at time of analysis, CISA SSVC reports Exploitation: none, and there is no KEV listing. Exposure depends on deployment - the debugger endpoint being unreachable, behind an authenticating proxy, or disabled materially lowers risk - and a vendor fix is available in 2026.2.19197.
Incorrect authorization in JetBrains YouTrack before 2026.2.18991 lets a user who holds only read-only access to a project overwrite that project's notification templates, an action that should require higher project privileges. The attack is network-reachable and needs no user interaction, but it does require an authenticated account (CVSS PR:L) that already has visibility into the target project, and the effect is scoped to a single project's notification configuration. Severity is moderate (vendor score 7.1; independently assessed impact limited to integrity, with no confidentiality or availability effect), EPSS is low at 0.31% (22nd percentile), CISA SSVC rates exploitation as none and non-automatable, and no public exploit code has been identified at time of analysis. JetBrains has released a fix.
Incorrect authorization in JetBrains YouTrack before versions 2025.3.160480 and 2026.1.14047 allows authenticated low-privilege users to modify linked issue entities they lack update permission on by issuing PUT requests directly to link sub-resources. The flaw bypasses YouTrack's permission model at the HTTP method level, enabling integrity violations across project boundaries-reflected in the CVSS scope change (S:C). No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized integrity modification in JetBrains YouTrack before 2026.2.18634 allows any authenticated low-privilege user to alter links on issues they are explicitly prohibited from accessing by exploiting the whiteboard clone operation. The whiteboard clone workflow fails to validate the cloning user's authorization against issues referenced in the board, enabling cross-boundary write access governed by CWE-862 (Missing Authorization). No public exploit has been identified at time of analysis, but the CVSS 7.7 vector (S:C, I:H, PR:L, AC:L) accurately reflects the low barrier to exploitation and the cross-domain integrity impact.
Cross-tenant GitHub App installation token theft in JetBrains YouTrack before 2026.2.18634 lets any authenticated user retrieve GitHub App installation tokens belonging to other tenants due to a shared, non-isolated token cache. The root cause is CWE-488 (Exposure of Data Element to Wrong Session): cached tokens were keyed without tenant-scope isolation. With a stolen installation token, an attacker can authenticate to the GitHub API as the victim organization's GitHub App, gaining access to that organization's repositories, pull requests, issues, and CI/CD integrations; no public exploit has been identified at time of analysis.
Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alter group memberships without proper server-side authorization validation, effectively granting themselves elevated rights. The flaw (CWE-266, Incorrect Privilege Assignment) means the application trusts client-supplied group membership parameters without enforcing that the requesting user has the authority to make such changes. With a CVSS base score of 8.8 and full C:H/I:H/A:H impact, successful exploitation yields the equivalent of full administrative control over the YouTrack instance.
Missing authorization in JetBrains YouTrack's REST API allows authenticated low-privileged users to access and modify restricted resources via Insecure Direct Object Reference (IDOR). Affected versions span all YouTrack releases prior to 2026.2.18788, 2026.1.14055, and 2025.3.161254 across three active release branches. An attacker with any valid account can enumerate or directly reference object identifiers in REST API calls to read or write data they should not have access to, with high confidentiality and integrity impact per the CVSS vector.
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing accounts by asserting a victim's email address without proving ownership of it. All YouTrack builds before 2025.3.161254 and 2026.1.14042 are affected. Because the flaw is a trust failure in how Helpdesk associates a self-provided email with an account, exploitation requires no credentials, no user interaction, and works against default configurations where Helpdesk is enabled. No public exploit identified at time of analysis.
Unauthorized project transfer between organizations in JetBrains YouTrack before version 2026.2.17917 exposes high-severity access control failure affecting any multi-tenant or multi-organization deployment. Any authenticated low-privileged user can transfer projects across organizational boundaries without holding the necessary authorization, resulting in high confidentiality and integrity impact against affected projects and their data. No public exploit or CISA KEV listing is identified at time of analysis, but the low attack complexity and authentication-only requirement make this straightforwardly exploitable by any active YouTrack user.
Stored cross-site scripting in JetBrains YouTrack before 2026.2.18068 allows remote attackers to persist malicious script payloads via the language label field of fenced code blocks in issues or comments. When any authenticated user views the affected content, the injected script executes within the YouTrack application origin - a scope change that enables session token theft, credential harvesting, or unauthorized actions on behalf of the victim (CVSS C:H). No public exploit code has been identified at time of analysis, but the low-complexity network vector makes this straightforward to weaponize once a reporter or contributor role is obtained.
Unauthenticated database backup disclosure in JetBrains YouTrack before 2025.3.156085, 2026.1.13913, and 2026.2.18112 allows a remote attacker to abuse a shared draft signature to download full database backups without any credentials. Because backups typically contain issue data, user records, and secrets, this is a high-impact confidentiality exposure. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.1 rating and trivial network exploitability make it a priority patch.
Missing authorization on the mailbox endpoint in JetBrains YouTrack enables any authenticated user to delete arbitrary entities across the platform, regardless of ownership or role. Affected versions span three active release branches: all releases prior to 2025.3.156085, 2026.1.13914, and 2026.2.18095. The CVSS 3.1 score of 8.1 (High) reflects high integrity and availability impact with a low-privilege authentication bar; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct-database-access code path, per CWE-306 (missing authentication for a critical function). All self-hosted YouTrack builds prior to the 2026.1.13757 / 2025.3.148033 / 2025.2.148048 / 2025.1.148120 / 2024.3.148430 / 2024.2.148429 fix trains are affected, and JetBrains rates it CVSS 10.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximal severity score and administrative impact make prompt patching essential.
Prototype pollution in JetBrains YouTrack's websandbox bridge (all versions before 2026.2.16593) lets an attacker who can reach the sandbox boundary corrupt JavaScript Object.prototype, potentially escaping the sandbox or disclosing information. The flaw was internally reported by JetBrains and classed as CWE-1321; it carries a vendor-published CVSS of 9.8, but no public exploit has been identified at time of analysis and EPSS rates exploitation probability low at 0.40% (32nd percentile).
Improper authorization in JetBrains YouTrack's app configurations endpoint lets remote attackers modify project settings they should not be permitted to change, affecting all versions before 2026.2.16593. The flaw (CWE-862, Missing Authorization) impacts integrity only - no data disclosure or service disruption - and was self-reported by JetBrains with a patch already available. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 5th percentile).
Information disclosure in JetBrains YouTrack before 2026.2.16593 allows remote attackers to read other users' private data through a missing authorization check on the comment templates endpoint. The flaw is unauthenticated and network-reachable per the CVSS vector (PR:N), exposing confidential information without any user interaction. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.16%, 6th percentile).
Information disclosure in JetBrains YouTrack before 2026.1.13162 allows remote unauthenticated attackers to obtain sensitive data through fetchApp requests. The flaw exposes confidential information without requiring authentication or user interaction, but carries no integrity or availability impact. There is no public exploit identified at time of analysis, and the EPSS score of 0.00% reflects no observed exploitation activity.
Sandbox escape in JetBrains YouTrack before 2025.3.131383 allows high-privileged users to execute arbitrary code on the server. The vulnerability affects all YouTrack versions prior to 2025.3.131383 and is classified as both an authentication bypass and server-side template injection (SSTI). EPSS scoring indicates 0% exploitation probability with no evidence of active exploitation or public POCs. Despite a CVSS score of 7.2, the requirement for high-level administrative privileges significantly constrains real-world attack surface to insider threats or compromised admin accounts.
Authenticated users in JetBrains YouTrack versions prior to 2025.3.121962 can bypass authorization controls to access the app permissions endpoint, potentially allowing privilege escalation or unauthorized modification of application settings. This vulnerability requires valid login credentials but has no complexity requirements, enabling attackers with low-level access to gain high-impact capabilities including confidentiality and integrity violations. No patch is currently available.
Missing authorization in the mail rules feature of JetBrains YouTrack allows an authenticated user holding project-administrator privileges to execute issue commands against projects they do not administer. The flaw (CWE-862) is reachable remotely over the network with low attack complexity, but it is privilege-gated: the attacker must already hold project-admin rights and the instance must process mail rules, so exposure is concentrated in multi-team or multi-tenant deployments where project administration is delegated. Impact is a serious integrity and confidentiality concern for affected projects (CVSS 6.5), but there is no public exploit identified at time of analysis and no indication of active exploitation. Fixed builds are available in the 2026.2 and 2026.3 release lines.
Server-side request forgery in JetBrains YouTrack before 2026.2.19422 allows an authenticated user holding administrative or project-level privileges to abuse the GitHub VCS integration and coerce the YouTrack server into issuing requests to destinations of the attacker's choosing. With a CVSS 3.1 base score of 5.5 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N), the impact is bounded to limited confidentiality and integrity loss with a scope change, and the high privilege prerequisite is the dominant limiting factor - this is a moderate-severity, low-real-world-priority issue rather than an anonymous or default-configuration exposure. At the time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis.
Authenticated users of JetBrains YouTrack before version 2026.2.19422 can read notifications belonging to other users by directly referencing inbox thread identifiers that lack a proper per-user ownership check. The flaw is a classic insecure direct object reference (CWE-639) reachable over the network with low complexity and no user interaction, but it requires a valid low-privilege account, so it is not exploitable by unauthenticated outsiders. Impact is limited to confidentiality - disclosure of other users' notification contents - with no evidence of modification, service disruption, active exploitation, or publicly available exploit code at time of analysis; EPSS and KEV data were not provided, and the vendor has released a fix.
Authenticated users on JetBrains YouTrack instances running versions prior to 2026.2.19422 can trigger unauthorized reloads of translation catalogs because the endpoint enforcing that operation lacks a proper authorization check (CWE-862). Exploitation is bounded by the CVSS vector (AV:N/AC:L/PR:L/UI:N) - a valid low-privileged account is required, and the impact is confined to availability (A:L) with no data disclosure or modification (C:N/I:N). No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation; the overall real-world risk is low, and the vendor has shipped a fixed release.
Privilege escalation in JetBrains YouTrack before 2026.2.19422 allows an authenticated attacker with pre-existing elevated privileges (CVSS PR:H) to abuse user-group membership changes and gain higher privileges, though success requires a specific group-configuration state (AC:H). The flaw is network-reachable (AV:N) and needs no user interaction (UI:N), but the high privilege and configuration prerequisites sharply narrow realistic risk to insiders or holders of a compromised privileged account; no public exploit identified at time of analysis. Vendor CVSS 6.6 Medium and CWE-266 (Incorrect Privilege Assignment) match the assessed vector and the need to manipulate group membership under constrained conditions.
Denial of service in JetBrains YouTrack instances running versions before 2026.2.19422 lets an authenticated user who can upload attachments hang or crash the server by submitting a crafted PSD file that drives the image-processing path into an infinite loop. The attack is network-reachable and needs no victim interaction, but it requires a valid low-privileged account (PR:L), so it is not exploitable by fully anonymous visitors unless the instance permits self-registration or guest attachment uploads; impact is confined to availability, with no confidentiality or integrity loss. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Authorization bypass in JetBrains YouTrack before 2026.2.19422 allows an authenticated user with only low privileges to read the activity history of restricted issues they are not authorized to view. The root cause is an insecure direct object reference in the issue activities API, where the endpoint resolves a caller-supplied issue identifier without verifying that the caller holds read access to that issue. Exploitation requires valid low-privileged credentials but no user interaction or non-default configuration, and the impact is confidentiality-only (CVSS 3.1 base 6.5, C:H/I:N/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in 2026.2.19422.
HTML injection in JetBrains YouTrack's VCS command failure notifications (before 2026.2.19422) allows an authenticated attacker with high privileges to inject arbitrary HTML into notifications, potentially leading to content spoofing or script execution, but a victim must view the crafted notification. The vulnerability requires high attack complexity, and no public exploit code or active exploitation has been identified. Despite the low CVSS score of 2.0, it is a genuine XSS flaw that should be remediated by upgrading to version 2026.2.19422 or later.
JetBrains YouTrack before 2026.2.19197 fails to enforce read permissions when creating a project from a custom template, allowing an authenticated low-privileged user to read template data they are not authorized to access. This missing authorization flaw (CWE-862) has a low confidentiality impact (CVSS 3.1) and requires high attack complexity, a valid account, and the existence of an unreadable custom template; no public exploit code has been identified. The vendor has released a patch in version 2026.2.19197.
Credential disclosure in JetBrains YouTrack before 2026.2.19197 lets an authenticated user who can edit an existing integration's configuration URL redirect the integration's stored credentials to an attacker-controlled endpoint by simply changing that URL. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity, low-privilege flaw with high confidentiality impact and no integrity or availability effect, consistent with a credential-theft bug rather than code execution or full takeover; no public exploit identified at time of analysis, and no exploitation status is confirmed by CISA KEV for this CVE.
Improper authorization in JetBrains YouTrack before 2026.2.19197 allows an authenticated user with restricted project permissions to edit and hide other users' comments. The flaw is an incorrect authorization check (CWE-863) that yields only integrity impact - no data disclosure or service disruption - and exploitation requires an existing YouTrack account. No public exploit code has been identified at the time of analysis, and a vendor patch is available in version 2026.2.19197.
Stored cross-site scripting in JetBrains YouTrack before 2026.2.19197 allows an attacker with privileges to create or modify workflows-effectively a project administrator or workflow author-to store script content that is later rendered in a workflow error notification toast. The victim must trigger the affected workflow error path (UI:R) for the payload to execute in their authenticated YouTrack browser session; this is not a remote unauthenticated attack against default configurations, and the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N keeps confidentiality and integrity impact low. Vendor-released patch 2026.2.19197 is available, and no public exploit identified at time of analysis.
Denial of service in JetBrains YouTrack affects all builds before 2026.2.19197, where a project administrator can craft a notification template that drives uncontrolled resource consumption on the server. The requirement for an authenticated account holding project Admin rights (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5) confines realistic exposure to malicious or compromised administrators rather than ordinary or anonymous users, and the impact is limited to availability with no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, though JetBrains has shipped a vendor patch in 2026.2.19197 and the flaw is tracked in ENISA EUVD as EUVD-2026-90018.
Missing authorization in the notification template preview of JetBrains YouTrack (versions before 2026.2.19197) allows an authenticated attacker who holds Project Administrator rights to read issues that are otherwise restricted from them. The flaw is network-exploitable with low attack complexity and no victim interaction, but the CVSS vector (PR:H) means the attacker must already be a privileged, semi-trusted insider within a project, which is why the score stays at 4.9 (Medium). There is no public exploit identified at time of analysis and no KEV listing; the vendor has released a fix in YouTrack 2026.2.19197 (tracked as EUVD-2026-90016).
JetBrains YouTrack before 2026.2.19197 contains a broken access control vulnerability (CWE-862) that allows authenticated users with low privileges to read information from projects they are not authorized to access via several endpoints lacking authorization checks. The flaw requires a valid account and impacts only confidentiality; no data modification or privilege escalation is possible. It is rated low severity (CVSS 2.7) and no public exploit has been identified at time of analysis.
JetBrains YouTrack before 2026.2.19197 can disclose integration credentials to an authenticated user who holds the low-level Admin Read permission through import configurations, allowing that user to view secrets that should remain restricted. The flaw is CWE-863 incorrect authorization with a vendor CVSS score of 3.3 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N), and the independent assessment further narrows impact to confidentiality only (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N). Exploitation requires high privileges, high attack complexity, and a vulnerable instance that has integrations with stored credentials; no public exploit identified at time of analysis, and vendor-released patch 2026.2.19197 is available, so real-world urgency is low.
Authorization bypass in JetBrains YouTrack before 2026.2.19197 lets an authenticated low-privileged user circumvent a helpdesk project's Authorized Reporters allowlist and file reports that the configuration was meant to block. The issue is network-reachable with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3), but its impact is limited to integrity - unauthorized report submission - with no confidentiality or availability effect. It applies only to instances where a helpdesk project has actually been configured with an Authorized Reporters restriction, and the CVSS PR:L metric confirms the attacker must already hold a valid low-privileged account rather than being fully anonymous; no public exploit identified at time of analysis.
Authenticated project administrators in JetBrains YouTrack before 2026.2.19197 can read comments from projects they do not administer by exploiting a notification-template authorization bypass. This network-exploitable flaw requires an account with project-administrator privileges and no user interaction, resulting in a high-confidentiality impact with a scope change (CVSS 7.7). No public exploit or active exploitation has been identified at time of analysis.
Denial of service in JetBrains YouTrack allows an unauthenticated remote attacker to exhaust server CPU and request-handling threads by sending crafted email content that triggers catastrophic regular-expression backtracking in mailbox mail-rule filters, affecting all releases up to 2026.2.19197. The impact is limited to availability (CVSS:C:N/I:N/A:H, base score 5.9); there is no confidentiality or integrity effect. Exposure is contingent on a non-default, operator-dependent configuration - the mailbox integration must be enabled with regex-based mail-rule filters - and there is no public exploit identified at time of analysis, so this is a genuine but modest-priority availability issue rather than a broadly exploitable one.
Stored SMTP credentials in JetBrains YouTrack can be exposed to an already-authenticated administrator by changing the configured SMTP server host, affecting versions before 2026.2.18991. The issue is rated CVSS 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), so confidentiality impact is limited and exploitation requires high-privilege access - in practice an insider or an attacker who has already compromised an admin account in an instance where outbound email/notification delivery is configured. A vendor patch is available, and no public exploit has been identified at time of analysis.
Stored HTML injection in JetBrains YouTrack before 2026.2.18991 allows unauthenticated remote attackers to plant attacker-controlled markup into the application through the User-Agent HTTP header, which is subsequently stored and rendered to other users without adequate output encoding. Impact is limited to Low confidentiality with a scope change and no integrity or availability effect; exploitation depends on user interaction (UI:R), as a user - typically an operator reviewing stored request or user-agent data - must open the affected page for the injected HTML to render. There is no public exploit identified at time of analysis, and the vendor has released a fix in version 2026.2.18991.
Improper authorization in JetBrains YouTrack allows an authenticated, low-privileged user to change a knowledge-base article's visibility settings even though that account does not hold the article update permission. Only instances running versions before 2026.2.18991 are affected, and the impact is limited to low confidentiality and low integrity with no availability impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV); the vendor has released a fixed build, making this a modest-severity broken access control issue rather than a top-tier priority.
Stale authentication material tied to JetBrains YouTrack's mailbox integration continues to be accepted after a user's password reset in versions prior to 2026.2.18991, letting an actor who already holds the pre-reset credentials keep authenticating through that path when the reset should have invalidated them. The flaw is limited to deployments that use the mailbox integration feature and to accounts that have actually undergone a password reset; the impact is integrity-only (no confidentiality or availability effect), and the assessed complexity is higher than the base 5.3 vector implies because a preceding reset plus possession of the stale credentials are both required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the vendor has released a fix.
Improper access control in JetBrains YouTrack before 2026.2.18991 lets an authenticated user who has only view-only permission on a Gantt chart perform edit operations that the access model should block. The flaw is network-reachable but requires a valid YouTrack account (PR:L), has no user-interaction component, and is confined to low-severity integrity impact on scheduling/Gantt data with no confidentiality or availability effect (CVSS 4.3, CWE-863). There is no confirmed active exploitation (CISA KEV not listed) and no public exploit identified at time of analysis; the vendor has released a fixed build in 2026.2.18991.
Read-only users in JetBrains YouTrack can read project settings they are not entitled to see because the application fails to enforce an authorization check on that data path in all versions before 2026.2.18991. Exploitation requires a valid, authenticated YouTrack account at the read-only privilege level (CVSS vector PR:L), and the resulting impact is limited to disclosure of project settings configuration data - no modification of data, no privilege escalation, and no impact on availability. Scoring is low at CVSS 4.3, there is no CISA KEV listing and no public exploit code identified at time of analysis, and JetBrains has shipped a fixed build (2026.2.18991), so this is a low-priority information-disclosure issue that should be handled through normal patch cadence.
Server-side request forgery in JetBrains YouTrack before 2026.2.18991 lets an authenticated user coerce the server-side PDF export renderer into making outbound requests to attacker-influenced URLs by storing crafted XHTML content that is rendered when that content is exported to PDF. The assessed impact is confidentiality-only (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and the attack requires a valid YouTrack account plus write access to a stored field that reaches the PDF renderer; no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Privilege escalation in JetBrains YouTrack before version 2026.1.14047 allows an authenticated user holding project update permissions to grant themselves the Project Admin role without proper authorization. The vulnerability stems from a missing escalation check (CWE-266: Incorrect Privilege Assignment) in the project permissions workflow, enabling a project contributor to cross a privilege boundary and assume administrative control over a project. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is known at time of analysis.
Authenticated users in JetBrains YouTrack before 2026.1.14047 can enumerate all group names via predefined search fields, bypassing group visibility permissions enforced elsewhere in the product. The flaw (CWE-862 Missing Authorization) means the access-control check applied to group visibility was not consistently applied to the predefined search field code path, leaking organizational structure to any logged-in user. No active exploitation has been identified and no public exploit code exists; CVSS 4.3 reflects the limited confidentiality impact.
Credential exfiltration in JetBrains YouTrack before 2026.2.18769 allows a project administrator to redirect stored mailbox credentials to an attacker-controlled server by modifying the mailbox host setting without triggering re-authentication. The missing re-authentication gate means any project admin who has been compromised, is malicious, or has temporarily elevated access can silently capture email account credentials (username and password) already stored in YouTrack. No public exploit has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Missing authorization (CWE-862) in JetBrains YouTrack before 2026.2.18769 allows any low-privileged authenticated user to read the email addresses of Helpdesk authorized reporters, who are external contacts registered to submit issues. The flaw bypasses the intended access control on the Helpdesk reporter roster, exposing personally identifiable contact data to users who should have no visibility into it. No public exploit is identified at time of analysis, and the vulnerability has been patched by JetBrains in version 2026.2.18769.
Missing server-side permission checks in JetBrains YouTrack before 2026.2.18687 allow any authenticated user to create knowledge base articles inside projects they are not authorized to access. The flaw is rooted in CWE-862 (Missing Authorization), where the article-creation endpoint omits the necessary access control validation against the caller's project permissions. No public exploit or active exploitation has been identified; the CVSS PR:L metric confirms exploitation is limited to users who already hold a valid YouTrack account.
Improper authorization in JetBrains YouTrack before 2026.2.18634 allows authenticated read-only users to create and modify whiteboard cards, exceeding their intended permissions. The flaw (CWE-863) bypasses YouTrack's role-based access controls for the whiteboard feature, enabling low-privileged users to perform write operations they should be denied. No public exploit code or active exploitation has been identified, and a vendor-confirmed fix is available. EPSS data was not provided; real-world risk is moderate given the authentication prerequisite.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows a high-privileged attacker to inject malicious scripts by uploading crafted project or organization icon files. When other authenticated users subsequently view the affected project or organization page, the stored payload executes in their browser context, enabling session data exposure or unauthorized in-application actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Insufficient permission checks on the app import endpoint in JetBrains YouTrack before version 2026.2.18634 allow an authenticated low-privileged user to overwrite bundled applications, achieving high-integrity impact across all unpatched deployments. The flaw is rooted in CWE-863 (Incorrect Authorization), meaning the server fails to validate that the requesting account holds sufficient privileges for a destructive write operation against pre-installed components. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in JetBrains YouTrack before 2026.2.18634 allows authenticated low-privileged users to enumerate and read private issues and starred folder contents belonging to other users across organizational boundaries by manipulating user profile API identifiers. The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/C:H) reflects straightforward network exploitation requiring only a valid session. No public exploit or KEV listing is present, but the low attack complexity and high confidentiality impact make this a meaningful data-exposure risk in multi-tenant or multi-organization YouTrack deployments.
Insecure Direct Object Reference in JetBrains YouTrack before version 2026.2.18634 permits authenticated users to access other users' private saved searches through the watchRules and issueListConfig API endpoints. The endpoints fail to enforce authorization checks on user-controlled object identifiers, allowing horizontal privilege escalation without elevated permissions. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Authorization bypass in JetBrains YouTrack's whiteboard feature allows authenticated read-only whiteboard users to modify canvas content they should only be able to view, by sending a crafted WebSocket message. Affected versions are all YouTrack releases before 2026.2.18634. The vulnerability stems from CWE-863 (Incorrect Authorization) - the server-side WebSocket handler fails to enforce the read-only permission boundary, accepting write operations from users who lack write privileges. No public exploit or active exploitation has been identified.
The generic VCS webhook handler in JetBrains YouTrack before 2026.2.18634 fails open when no webhook secret is configured, allowing unauthenticated remote callers to trigger webhook processing without any valid credential check. This CWE-306 flaw means that deployments where the webhook secret field is intentionally or inadvertently left blank accept all inbound webhook payloads as legitimate, bypassing the shared-secret verification mechanism. No public exploit code has been identified and the vulnerability is not in CISA KEV; the low CVSS score of 3.7 with AC:H accurately reflects that exploitation is constrained to misconfigured instances.
IP spoofing via forged HTTP headers in JetBrains YouTrack before 2026.2.18634 allows unauthenticated remote attackers to bypass Bitbucket webhook source validation, causing YouTrack to process attacker-crafted webhook payloads as if they originated from a legitimate Bitbucket server. The root cause is CWE-291 - reliance on IP address for authentication - specifically trusting client-controlled headers such as X-Forwarded-For to gate webhook acceptance. No public exploit has been identified at time of analysis, and JetBrains has released a patched build.
Stored XSS in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privilege users to inject AngularJS template expressions through issue assignee name fields, which are then evaluated as client-side JavaScript in the browsers of any user who views the affected issue or project board. The attack persists server-side, meaning every subsequent viewer triggers execution without further attacker interaction. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privileged users to inject persistent malicious scripts through custom field values displayed on Agile board cards. When a victim with an active YouTrack session views the affected Agile board, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code has been identified at time of analysis, and JetBrains has released a patched version.
Signed URL reuse in JetBrains YouTrack before 2026.2.18634 permits authenticated users to access restricted project icons they are not authorized to view. The flaw arises because signed URLs generated for project icon assets are not properly scoped or invalidated, allowing the same URL to be reused beyond its intended access context. No public exploit code has been identified and the vendor has issued a patch, making this a low-urgency but straightforward authorization control deficiency in a widely used issue tracker.
Denial-of-service in JetBrains YouTrack before versions 2026.1.13901 and 2026.2.17950 allows authenticated remote attackers to exhaust server resources by submitting crafted type parameters, rendering the service unavailable. The vulnerability stems from uncontrolled resource consumption (CWE-770), where malformed input is not bounded before processing. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized cross-project article disclosure in JetBrains YouTrack allows any authenticated user to read restricted knowledge base articles belonging to projects they are not authorized to access, by exploiting a missing authorization check on the draft creation endpoint. Affected are all YouTrack deployments running versions before 2026.1.13903 and 2026.2.17950. No public exploit or active exploitation has been identified, but the low attack complexity and network-accessible vector make this trivially repeatable by any valid account holder on the instance.
Denial-of-service in JetBrains YouTrack before 2026.2.18177 allows an authenticated low-privileged user to exhaust server resources by uploading a decompression bomb to the import endpoint. The CVSS vector confirms full availability impact (A:H) with no confidentiality or integrity consequences. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, making this a moderate-priority internal threat requiring authenticated access.
Account enumeration in JetBrains YouTrack before version 2026.2.18112 exposes internal user accounts to any authenticated user through insufficient authorization controls on the users search endpoint. The root cause is CWE-862 (Missing Authorization): the endpoint performs no privilege check beyond requiring a valid session, allowing low-privilege users to systematically extract account identifiers across the entire instance. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the straightforward exploitation path makes patching a clear priority.
Stored XSS in JetBrains YouTrack before 2026.2.17394 allows low-privileged authenticated users to inject malicious scripts into article titles, which are then rendered unsanitized within digest emails delivered to other users. When a recipient opens the digest email in an HTML-capable client and interacts with the affected content, the injected script executes in their browser context, enabling session token or credential theft. No public exploit or active exploitation has been identified; the CVSS score of 3.5 (Low) reflects the constrained impact due to required authentication, mandatory user interaction, and limited confidentiality-only impact.
CSS injection via Mermaid diagram rendering in JetBrains YouTrack before version 2026.2.17012 permits authenticated low-privilege users to embed malicious CSS into diagram content that executes in the browsers of other users who view the affected page. The CVSS score of 3.5 (Low) reflects the dual gating conditions of required authentication and victim interaction, substantially constraining real-world impact to UI manipulation rather than data exfiltration or code execution. No public exploit code or active exploitation has been identified at time of analysis.
Improper access control in JetBrains YouTrack before version 2026.2.16593 permits authenticated low-privileged users to read saved queries and tags outside their authorized scope. The flaw stems from missing authorization checks (CWE-862), meaning the application fails to verify whether the requesting user holds the required permissions before serving these resources over the network. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the network-accessible nature of the issue means any authenticated user on an exposed YouTrack instance is a potential threat actor.
Excessive user profile data disclosure in JetBrains YouTrack before 2026.2.16593 results from overly permissive default role configuration, allowing any authenticated low-privilege user to read more user profile attributes than intended. The root cause is CWE-276 (Incorrect Default Permissions), where the shipped default role grants broader read access to user directory data than the principle of least privilege requires. No public exploit or confirmed active exploitation exists at time of analysis.
Project settings disclosure in JetBrains YouTrack before version 2026.2.16593 allows an authenticated low-privileged user to read project configuration data they are not authorized to access via the MCP (Model Context Protocol) integration. The root cause is a missing authorization check (CWE-862) on MCP-exposed endpoints, meaning the server returns project settings without validating the requesting user's project-level permissions. No public exploit has been identified at time of analysis, no KEV listing exists, and a vendor-released patch is available.
Improper access control in JetBrains YouTrack before 2026.1.13570 permits any authenticated low-privileged user to enumerate restricted issues and articles through the Planning Canvas feature, exposing confidential project data they are not authorized to view. Rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), the flaw allows user-controlled identifiers to bypass access restrictions without proper authorization checks. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Improper access control in JetBrains YouTrack before version 2026.1.13570 permits any low-privileged authenticated user to modify service accounts, an administrative operation that should be restricted to privileged roles. Rooted in CWE-862 (Missing Authorization), the flaw is exploitable over the network with low complexity, requiring no user interaction - meaning any valid account holder on an exposed instance can tamper with service account configurations. No public exploit or CISA KEV listing has been identified at time of analysis, but the integrity impact is rated high given the sensitivity of service account access in YouTrack deployments.
Information disclosure in JetBrains YouTrack before version 2026.1.13162 allows authenticated low-privilege users to access sensitive user and group membership data they are not authorized to view. Rooted in CWE-863 (Incorrect Authorization), the flaw exists on the Users and Groups administrative pages, where authorization checks are insufficiently enforced for authenticated sessions. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the low access complexity means any authenticated attacker can reliably reproduce the condition.
Stored cross-site scripting in JetBrains YouTrack versions prior to 2026.1.13162 allows an authenticated project-level user to inject persistent JavaScript into project notification templates, which executes in the browsers of other users who receive or view those notifications. The scope-changed CVSS 8.7 reflects that injected scripts can pivot beyond the vulnerable component to compromise the sessions and data of higher-privileged recipients. No public exploit identified at time of analysis and no KEV listing, but the issue was disclosed and patched directly by the vendor.
Youtrack versions up to 2025.3.119033 is affected by insertion of sensitive information into log file (CVSS 6.5).
In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored XSS in JetBrains YouTrack before 2026.2.19422 allows an authenticated user with content-creation rights to inject malicious Mermaid or LaTeX markup that executes in the browser of any user who views the affected issue, comment, or similar content. The vendor CVSS is 8.1, but the independent assessment lowers this to CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting required authentication (unless anonymous/guest issue reporting is enabled), victim interaction, and low confidentiality/integrity impact; signals lean toward moderate real-world priority. No public exploit code or CISA KEV active exploitation was identified at time of analysis.
Privilege escalation in JetBrains YouTrack lets an authenticated holder of an already-high-privilege (non-admin) account raise their effective permissions by abusing the user group links functionality, where a required authorization check is missing (CWE-862). All YouTrack releases before 2026.2.19422 are affected, and the issue is scored CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) with high confidentiality, integrity, and availability impact once triggered, requiring no user interaction. The PR:H prerequisite meaningfully bounds exposure - anonymous or fully unprivileged users cannot exploit it - and there is no public exploit identified at time of analysis, making this a real but gated finding rather than an urgent fire-drill.
Broken access control in JetBrains YouTrack before 2026.2.19422 allows any authenticated user to add themselves to a project team, gaining unauthorized access to restricted issues. This CVE-2026-103488 has a CVSS score of 7.1 and requires a low-privileged account (PR:L); no public exploit code has been identified at time of analysis. The flaw is classified as CWE-863 (Incorrect Authorization) and affects all YouTrack versions prior to the fixed release 2026.2.19422.
Account takeover in JetBrains YouTrack before 2026.2.19197 is possible because the application accepts a replayed notification signature, allowing an attacker who has captured a legitimate signature to authenticate as the associated account. Every YouTrack instance running an earlier build is affected (CPE cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*), and the root cause is an incorrect-authorization flaw (CWE-863) rather than memory corruption. The practical barrier is signature acquisition: our assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (high, not the input's 9.8 critical) because exploitation depends on capturing or observing a victim's notification signature rather than a blind unauthenticated request against a default install. No public exploit code and no confirmed active exploitation have been identified (EPSS 0.33%, 24th percentile; CISA SSVC lists Exploitation: none), and JetBrains has released a fix in 2026.2.19197.
Incorrect authorization in JetBrains YouTrack before version 2026.2.19197 allows guest users to strip a workflow action's visibility restriction and then execute that action, altering workflow behavior on the instance. The flaw is network-reachable and rated CVSS 7.5 with a PR:N vector, though practical exposure depends on guest access being enabled on the target instance - a configuration in which the guest context supplies the effective precondition; disabling guest access removes the attack surface entirely. Impact is limited to integrity of workflow actions (no confidentiality or availability effect), there is no public exploit identified at time of analysis, EPSS is low (0.29%, roughly 19th percentile), CISA SSVC records exploitation status as none, and the vendor has released a patch in 2026.2.19197.
Unauthenticated remote attackers can execute arbitrary code in JetBrains YouTrack before 2026.2.19197 by abusing an authorisation bypass in the scripts debugger, a CVSS 3.1 9.8 flaw (PR:N/UI:N, scope unchanged, confidentiality/integrity/availability all High). Real-world urgency is low despite the score: EPSS is 0.36% (28th percentile), no public exploit code has been identified at time of analysis, CISA SSVC reports Exploitation: none, and there is no KEV listing. Exposure depends on deployment - the debugger endpoint being unreachable, behind an authenticating proxy, or disabled materially lowers risk - and a vendor fix is available in 2026.2.19197.
Incorrect authorization in JetBrains YouTrack before 2026.2.18991 lets a user who holds only read-only access to a project overwrite that project's notification templates, an action that should require higher project privileges. The attack is network-reachable and needs no user interaction, but it does require an authenticated account (CVSS PR:L) that already has visibility into the target project, and the effect is scoped to a single project's notification configuration. Severity is moderate (vendor score 7.1; independently assessed impact limited to integrity, with no confidentiality or availability effect), EPSS is low at 0.31% (22nd percentile), CISA SSVC rates exploitation as none and non-automatable, and no public exploit code has been identified at time of analysis. JetBrains has released a fix.
Incorrect authorization in JetBrains YouTrack before versions 2025.3.160480 and 2026.1.14047 allows authenticated low-privilege users to modify linked issue entities they lack update permission on by issuing PUT requests directly to link sub-resources. The flaw bypasses YouTrack's permission model at the HTTP method level, enabling integrity violations across project boundaries-reflected in the CVSS scope change (S:C). No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized integrity modification in JetBrains YouTrack before 2026.2.18634 allows any authenticated low-privilege user to alter links on issues they are explicitly prohibited from accessing by exploiting the whiteboard clone operation. The whiteboard clone workflow fails to validate the cloning user's authorization against issues referenced in the board, enabling cross-boundary write access governed by CWE-862 (Missing Authorization). No public exploit has been identified at time of analysis, but the CVSS 7.7 vector (S:C, I:H, PR:L, AC:L) accurately reflects the low barrier to exploitation and the cross-domain integrity impact.
Cross-tenant GitHub App installation token theft in JetBrains YouTrack before 2026.2.18634 lets any authenticated user retrieve GitHub App installation tokens belonging to other tenants due to a shared, non-isolated token cache. The root cause is CWE-488 (Exposure of Data Element to Wrong Session): cached tokens were keyed without tenant-scope isolation. With a stolen installation token, an attacker can authenticate to the GitHub API as the victim organization's GitHub App, gaining access to that organization's repositories, pull requests, issues, and CI/CD integrations; no public exploit has been identified at time of analysis.
Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alter group memberships without proper server-side authorization validation, effectively granting themselves elevated rights. The flaw (CWE-266, Incorrect Privilege Assignment) means the application trusts client-supplied group membership parameters without enforcing that the requesting user has the authority to make such changes. With a CVSS base score of 8.8 and full C:H/I:H/A:H impact, successful exploitation yields the equivalent of full administrative control over the YouTrack instance.
Missing authorization in JetBrains YouTrack's REST API allows authenticated low-privileged users to access and modify restricted resources via Insecure Direct Object Reference (IDOR). Affected versions span all YouTrack releases prior to 2026.2.18788, 2026.1.14055, and 2025.3.161254 across three active release branches. An attacker with any valid account can enumerate or directly reference object identifiers in REST API calls to read or write data they should not have access to, with high confidentiality and integrity impact per the CVSS vector.
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing accounts by asserting a victim's email address without proving ownership of it. All YouTrack builds before 2025.3.161254 and 2026.1.14042 are affected. Because the flaw is a trust failure in how Helpdesk associates a self-provided email with an account, exploitation requires no credentials, no user interaction, and works against default configurations where Helpdesk is enabled. No public exploit identified at time of analysis.
Unauthorized project transfer between organizations in JetBrains YouTrack before version 2026.2.17917 exposes high-severity access control failure affecting any multi-tenant or multi-organization deployment. Any authenticated low-privileged user can transfer projects across organizational boundaries without holding the necessary authorization, resulting in high confidentiality and integrity impact against affected projects and their data. No public exploit or CISA KEV listing is identified at time of analysis, but the low attack complexity and authentication-only requirement make this straightforwardly exploitable by any active YouTrack user.
Stored cross-site scripting in JetBrains YouTrack before 2026.2.18068 allows remote attackers to persist malicious script payloads via the language label field of fenced code blocks in issues or comments. When any authenticated user views the affected content, the injected script executes within the YouTrack application origin - a scope change that enables session token theft, credential harvesting, or unauthorized actions on behalf of the victim (CVSS C:H). No public exploit code has been identified at time of analysis, but the low-complexity network vector makes this straightforward to weaponize once a reporter or contributor role is obtained.
Unauthenticated database backup disclosure in JetBrains YouTrack before 2025.3.156085, 2026.1.13913, and 2026.2.18112 allows a remote attacker to abuse a shared draft signature to download full database backups without any credentials. Because backups typically contain issue data, user records, and secrets, this is a high-impact confidentiality exposure. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.1 rating and trivial network exploitability make it a priority patch.
Missing authorization on the mailbox endpoint in JetBrains YouTrack enables any authenticated user to delete arbitrary entities across the platform, regardless of ownership or role. Affected versions span three active release branches: all releases prior to 2025.3.156085, 2026.1.13914, and 2026.2.18095. The CVSS 3.1 score of 8.1 (High) reflects high integrity and availability impact with a low-privilege authentication bar; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct-database-access code path, per CWE-306 (missing authentication for a critical function). All self-hosted YouTrack builds prior to the 2026.1.13757 / 2025.3.148033 / 2025.2.148048 / 2025.1.148120 / 2024.3.148430 / 2024.2.148429 fix trains are affected, and JetBrains rates it CVSS 10.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximal severity score and administrative impact make prompt patching essential.
Prototype pollution in JetBrains YouTrack's websandbox bridge (all versions before 2026.2.16593) lets an attacker who can reach the sandbox boundary corrupt JavaScript Object.prototype, potentially escaping the sandbox or disclosing information. The flaw was internally reported by JetBrains and classed as CWE-1321; it carries a vendor-published CVSS of 9.8, but no public exploit has been identified at time of analysis and EPSS rates exploitation probability low at 0.40% (32nd percentile).
Improper authorization in JetBrains YouTrack's app configurations endpoint lets remote attackers modify project settings they should not be permitted to change, affecting all versions before 2026.2.16593. The flaw (CWE-862, Missing Authorization) impacts integrity only - no data disclosure or service disruption - and was self-reported by JetBrains with a patch already available. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 5th percentile).
Information disclosure in JetBrains YouTrack before 2026.2.16593 allows remote attackers to read other users' private data through a missing authorization check on the comment templates endpoint. The flaw is unauthenticated and network-reachable per the CVSS vector (PR:N), exposing confidential information without any user interaction. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.16%, 6th percentile).
Information disclosure in JetBrains YouTrack before 2026.1.13162 allows remote unauthenticated attackers to obtain sensitive data through fetchApp requests. The flaw exposes confidential information without requiring authentication or user interaction, but carries no integrity or availability impact. There is no public exploit identified at time of analysis, and the EPSS score of 0.00% reflects no observed exploitation activity.
Sandbox escape in JetBrains YouTrack before 2025.3.131383 allows high-privileged users to execute arbitrary code on the server. The vulnerability affects all YouTrack versions prior to 2025.3.131383 and is classified as both an authentication bypass and server-side template injection (SSTI). EPSS scoring indicates 0% exploitation probability with no evidence of active exploitation or public POCs. Despite a CVSS score of 7.2, the requirement for high-level administrative privileges significantly constrains real-world attack surface to insider threats or compromised admin accounts.
Authenticated users in JetBrains YouTrack versions prior to 2025.3.121962 can bypass authorization controls to access the app permissions endpoint, potentially allowing privilege escalation or unauthorized modification of application settings. This vulnerability requires valid login credentials but has no complexity requirements, enabling attackers with low-level access to gain high-impact capabilities including confidentiality and integrity violations. No patch is currently available.
Missing authorization in the mail rules feature of JetBrains YouTrack allows an authenticated user holding project-administrator privileges to execute issue commands against projects they do not administer. The flaw (CWE-862) is reachable remotely over the network with low attack complexity, but it is privilege-gated: the attacker must already hold project-admin rights and the instance must process mail rules, so exposure is concentrated in multi-team or multi-tenant deployments where project administration is delegated. Impact is a serious integrity and confidentiality concern for affected projects (CVSS 6.5), but there is no public exploit identified at time of analysis and no indication of active exploitation. Fixed builds are available in the 2026.2 and 2026.3 release lines.
Server-side request forgery in JetBrains YouTrack before 2026.2.19422 allows an authenticated user holding administrative or project-level privileges to abuse the GitHub VCS integration and coerce the YouTrack server into issuing requests to destinations of the attacker's choosing. With a CVSS 3.1 base score of 5.5 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N), the impact is bounded to limited confidentiality and integrity loss with a scope change, and the high privilege prerequisite is the dominant limiting factor - this is a moderate-severity, low-real-world-priority issue rather than an anonymous or default-configuration exposure. At the time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis.
Authenticated users of JetBrains YouTrack before version 2026.2.19422 can read notifications belonging to other users by directly referencing inbox thread identifiers that lack a proper per-user ownership check. The flaw is a classic insecure direct object reference (CWE-639) reachable over the network with low complexity and no user interaction, but it requires a valid low-privilege account, so it is not exploitable by unauthenticated outsiders. Impact is limited to confidentiality - disclosure of other users' notification contents - with no evidence of modification, service disruption, active exploitation, or publicly available exploit code at time of analysis; EPSS and KEV data were not provided, and the vendor has released a fix.
Authenticated users on JetBrains YouTrack instances running versions prior to 2026.2.19422 can trigger unauthorized reloads of translation catalogs because the endpoint enforcing that operation lacks a proper authorization check (CWE-862). Exploitation is bounded by the CVSS vector (AV:N/AC:L/PR:L/UI:N) - a valid low-privileged account is required, and the impact is confined to availability (A:L) with no data disclosure or modification (C:N/I:N). No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation; the overall real-world risk is low, and the vendor has shipped a fixed release.
Privilege escalation in JetBrains YouTrack before 2026.2.19422 allows an authenticated attacker with pre-existing elevated privileges (CVSS PR:H) to abuse user-group membership changes and gain higher privileges, though success requires a specific group-configuration state (AC:H). The flaw is network-reachable (AV:N) and needs no user interaction (UI:N), but the high privilege and configuration prerequisites sharply narrow realistic risk to insiders or holders of a compromised privileged account; no public exploit identified at time of analysis. Vendor CVSS 6.6 Medium and CWE-266 (Incorrect Privilege Assignment) match the assessed vector and the need to manipulate group membership under constrained conditions.
Denial of service in JetBrains YouTrack instances running versions before 2026.2.19422 lets an authenticated user who can upload attachments hang or crash the server by submitting a crafted PSD file that drives the image-processing path into an infinite loop. The attack is network-reachable and needs no victim interaction, but it requires a valid low-privileged account (PR:L), so it is not exploitable by fully anonymous visitors unless the instance permits self-registration or guest attachment uploads; impact is confined to availability, with no confidentiality or integrity loss. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Authorization bypass in JetBrains YouTrack before 2026.2.19422 allows an authenticated user with only low privileges to read the activity history of restricted issues they are not authorized to view. The root cause is an insecure direct object reference in the issue activities API, where the endpoint resolves a caller-supplied issue identifier without verifying that the caller holds read access to that issue. Exploitation requires valid low-privileged credentials but no user interaction or non-default configuration, and the impact is confidentiality-only (CVSS 3.1 base 6.5, C:H/I:N/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in 2026.2.19422.
HTML injection in JetBrains YouTrack's VCS command failure notifications (before 2026.2.19422) allows an authenticated attacker with high privileges to inject arbitrary HTML into notifications, potentially leading to content spoofing or script execution, but a victim must view the crafted notification. The vulnerability requires high attack complexity, and no public exploit code or active exploitation has been identified. Despite the low CVSS score of 2.0, it is a genuine XSS flaw that should be remediated by upgrading to version 2026.2.19422 or later.
JetBrains YouTrack before 2026.2.19197 fails to enforce read permissions when creating a project from a custom template, allowing an authenticated low-privileged user to read template data they are not authorized to access. This missing authorization flaw (CWE-862) has a low confidentiality impact (CVSS 3.1) and requires high attack complexity, a valid account, and the existence of an unreadable custom template; no public exploit code has been identified. The vendor has released a patch in version 2026.2.19197.
Credential disclosure in JetBrains YouTrack before 2026.2.19197 lets an authenticated user who can edit an existing integration's configuration URL redirect the integration's stored credentials to an attacker-controlled endpoint by simply changing that URL. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity, low-privilege flaw with high confidentiality impact and no integrity or availability effect, consistent with a credential-theft bug rather than code execution or full takeover; no public exploit identified at time of analysis, and no exploitation status is confirmed by CISA KEV for this CVE.
Improper authorization in JetBrains YouTrack before 2026.2.19197 allows an authenticated user with restricted project permissions to edit and hide other users' comments. The flaw is an incorrect authorization check (CWE-863) that yields only integrity impact - no data disclosure or service disruption - and exploitation requires an existing YouTrack account. No public exploit code has been identified at the time of analysis, and a vendor patch is available in version 2026.2.19197.
Stored cross-site scripting in JetBrains YouTrack before 2026.2.19197 allows an attacker with privileges to create or modify workflows-effectively a project administrator or workflow author-to store script content that is later rendered in a workflow error notification toast. The victim must trigger the affected workflow error path (UI:R) for the payload to execute in their authenticated YouTrack browser session; this is not a remote unauthenticated attack against default configurations, and the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N keeps confidentiality and integrity impact low. Vendor-released patch 2026.2.19197 is available, and no public exploit identified at time of analysis.
Denial of service in JetBrains YouTrack affects all builds before 2026.2.19197, where a project administrator can craft a notification template that drives uncontrolled resource consumption on the server. The requirement for an authenticated account holding project Admin rights (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5) confines realistic exposure to malicious or compromised administrators rather than ordinary or anonymous users, and the impact is limited to availability with no confidentiality or integrity loss. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, though JetBrains has shipped a vendor patch in 2026.2.19197 and the flaw is tracked in ENISA EUVD as EUVD-2026-90018.
Missing authorization in the notification template preview of JetBrains YouTrack (versions before 2026.2.19197) allows an authenticated attacker who holds Project Administrator rights to read issues that are otherwise restricted from them. The flaw is network-exploitable with low attack complexity and no victim interaction, but the CVSS vector (PR:H) means the attacker must already be a privileged, semi-trusted insider within a project, which is why the score stays at 4.9 (Medium). There is no public exploit identified at time of analysis and no KEV listing; the vendor has released a fix in YouTrack 2026.2.19197 (tracked as EUVD-2026-90016).
JetBrains YouTrack before 2026.2.19197 contains a broken access control vulnerability (CWE-862) that allows authenticated users with low privileges to read information from projects they are not authorized to access via several endpoints lacking authorization checks. The flaw requires a valid account and impacts only confidentiality; no data modification or privilege escalation is possible. It is rated low severity (CVSS 2.7) and no public exploit has been identified at time of analysis.
JetBrains YouTrack before 2026.2.19197 can disclose integration credentials to an authenticated user who holds the low-level Admin Read permission through import configurations, allowing that user to view secrets that should remain restricted. The flaw is CWE-863 incorrect authorization with a vendor CVSS score of 3.3 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N), and the independent assessment further narrows impact to confidentiality only (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N). Exploitation requires high privileges, high attack complexity, and a vulnerable instance that has integrations with stored credentials; no public exploit identified at time of analysis, and vendor-released patch 2026.2.19197 is available, so real-world urgency is low.
Authorization bypass in JetBrains YouTrack before 2026.2.19197 lets an authenticated low-privileged user circumvent a helpdesk project's Authorized Reporters allowlist and file reports that the configuration was meant to block. The issue is network-reachable with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3), but its impact is limited to integrity - unauthorized report submission - with no confidentiality or availability effect. It applies only to instances where a helpdesk project has actually been configured with an Authorized Reporters restriction, and the CVSS PR:L metric confirms the attacker must already hold a valid low-privileged account rather than being fully anonymous; no public exploit identified at time of analysis.
Authenticated project administrators in JetBrains YouTrack before 2026.2.19197 can read comments from projects they do not administer by exploiting a notification-template authorization bypass. This network-exploitable flaw requires an account with project-administrator privileges and no user interaction, resulting in a high-confidentiality impact with a scope change (CVSS 7.7). No public exploit or active exploitation has been identified at time of analysis.
Denial of service in JetBrains YouTrack allows an unauthenticated remote attacker to exhaust server CPU and request-handling threads by sending crafted email content that triggers catastrophic regular-expression backtracking in mailbox mail-rule filters, affecting all releases up to 2026.2.19197. The impact is limited to availability (CVSS:C:N/I:N/A:H, base score 5.9); there is no confidentiality or integrity effect. Exposure is contingent on a non-default, operator-dependent configuration - the mailbox integration must be enabled with regex-based mail-rule filters - and there is no public exploit identified at time of analysis, so this is a genuine but modest-priority availability issue rather than a broadly exploitable one.
Stored SMTP credentials in JetBrains YouTrack can be exposed to an already-authenticated administrator by changing the configured SMTP server host, affecting versions before 2026.2.18991. The issue is rated CVSS 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N), so confidentiality impact is limited and exploitation requires high-privilege access - in practice an insider or an attacker who has already compromised an admin account in an instance where outbound email/notification delivery is configured. A vendor patch is available, and no public exploit has been identified at time of analysis.
Stored HTML injection in JetBrains YouTrack before 2026.2.18991 allows unauthenticated remote attackers to plant attacker-controlled markup into the application through the User-Agent HTTP header, which is subsequently stored and rendered to other users without adequate output encoding. Impact is limited to Low confidentiality with a scope change and no integrity or availability effect; exploitation depends on user interaction (UI:R), as a user - typically an operator reviewing stored request or user-agent data - must open the affected page for the injected HTML to render. There is no public exploit identified at time of analysis, and the vendor has released a fix in version 2026.2.18991.
Improper authorization in JetBrains YouTrack allows an authenticated, low-privileged user to change a knowledge-base article's visibility settings even though that account does not hold the article update permission. Only instances running versions before 2026.2.18991 are affected, and the impact is limited to low confidentiality and low integrity with no availability impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV); the vendor has released a fixed build, making this a modest-severity broken access control issue rather than a top-tier priority.
Stale authentication material tied to JetBrains YouTrack's mailbox integration continues to be accepted after a user's password reset in versions prior to 2026.2.18991, letting an actor who already holds the pre-reset credentials keep authenticating through that path when the reset should have invalidated them. The flaw is limited to deployments that use the mailbox integration feature and to accounts that have actually undergone a password reset; the impact is integrity-only (no confidentiality or availability effect), and the assessed complexity is higher than the base 5.3 vector implies because a preceding reset plus possession of the stale credentials are both required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the vendor has released a fix.
Improper access control in JetBrains YouTrack before 2026.2.18991 lets an authenticated user who has only view-only permission on a Gantt chart perform edit operations that the access model should block. The flaw is network-reachable but requires a valid YouTrack account (PR:L), has no user-interaction component, and is confined to low-severity integrity impact on scheduling/Gantt data with no confidentiality or availability effect (CVSS 4.3, CWE-863). There is no confirmed active exploitation (CISA KEV not listed) and no public exploit identified at time of analysis; the vendor has released a fixed build in 2026.2.18991.
Read-only users in JetBrains YouTrack can read project settings they are not entitled to see because the application fails to enforce an authorization check on that data path in all versions before 2026.2.18991. Exploitation requires a valid, authenticated YouTrack account at the read-only privilege level (CVSS vector PR:L), and the resulting impact is limited to disclosure of project settings configuration data - no modification of data, no privilege escalation, and no impact on availability. Scoring is low at CVSS 4.3, there is no CISA KEV listing and no public exploit code identified at time of analysis, and JetBrains has shipped a fixed build (2026.2.18991), so this is a low-priority information-disclosure issue that should be handled through normal patch cadence.
Server-side request forgery in JetBrains YouTrack before 2026.2.18991 lets an authenticated user coerce the server-side PDF export renderer into making outbound requests to attacker-influenced URLs by storing crafted XHTML content that is rendered when that content is exported to PDF. The assessed impact is confidentiality-only (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and the attack requires a valid YouTrack account plus write access to a stored field that reaches the PDF renderer; no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Privilege escalation in JetBrains YouTrack before version 2026.1.14047 allows an authenticated user holding project update permissions to grant themselves the Project Admin role without proper authorization. The vulnerability stems from a missing escalation check (CWE-266: Incorrect Privilege Assignment) in the project permissions workflow, enabling a project contributor to cross a privilege boundary and assume administrative control over a project. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is known at time of analysis.
Authenticated users in JetBrains YouTrack before 2026.1.14047 can enumerate all group names via predefined search fields, bypassing group visibility permissions enforced elsewhere in the product. The flaw (CWE-862 Missing Authorization) means the access-control check applied to group visibility was not consistently applied to the predefined search field code path, leaking organizational structure to any logged-in user. No active exploitation has been identified and no public exploit code exists; CVSS 4.3 reflects the limited confidentiality impact.
Credential exfiltration in JetBrains YouTrack before 2026.2.18769 allows a project administrator to redirect stored mailbox credentials to an attacker-controlled server by modifying the mailbox host setting without triggering re-authentication. The missing re-authentication gate means any project admin who has been compromised, is malicious, or has temporarily elevated access can silently capture email account credentials (username and password) already stored in YouTrack. No public exploit has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Missing authorization (CWE-862) in JetBrains YouTrack before 2026.2.18769 allows any low-privileged authenticated user to read the email addresses of Helpdesk authorized reporters, who are external contacts registered to submit issues. The flaw bypasses the intended access control on the Helpdesk reporter roster, exposing personally identifiable contact data to users who should have no visibility into it. No public exploit is identified at time of analysis, and the vulnerability has been patched by JetBrains in version 2026.2.18769.
Missing server-side permission checks in JetBrains YouTrack before 2026.2.18687 allow any authenticated user to create knowledge base articles inside projects they are not authorized to access. The flaw is rooted in CWE-862 (Missing Authorization), where the article-creation endpoint omits the necessary access control validation against the caller's project permissions. No public exploit or active exploitation has been identified; the CVSS PR:L metric confirms exploitation is limited to users who already hold a valid YouTrack account.
Improper authorization in JetBrains YouTrack before 2026.2.18634 allows authenticated read-only users to create and modify whiteboard cards, exceeding their intended permissions. The flaw (CWE-863) bypasses YouTrack's role-based access controls for the whiteboard feature, enabling low-privileged users to perform write operations they should be denied. No public exploit code or active exploitation has been identified, and a vendor-confirmed fix is available. EPSS data was not provided; real-world risk is moderate given the authentication prerequisite.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows a high-privileged attacker to inject malicious scripts by uploading crafted project or organization icon files. When other authenticated users subsequently view the affected project or organization page, the stored payload executes in their browser context, enabling session data exposure or unauthorized in-application actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Insufficient permission checks on the app import endpoint in JetBrains YouTrack before version 2026.2.18634 allow an authenticated low-privileged user to overwrite bundled applications, achieving high-integrity impact across all unpatched deployments. The flaw is rooted in CWE-863 (Incorrect Authorization), meaning the server fails to validate that the requesting account holds sufficient privileges for a destructive write operation against pre-installed components. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in JetBrains YouTrack before 2026.2.18634 allows authenticated low-privileged users to enumerate and read private issues and starred folder contents belonging to other users across organizational boundaries by manipulating user profile API identifiers. The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/C:H) reflects straightforward network exploitation requiring only a valid session. No public exploit or KEV listing is present, but the low attack complexity and high confidentiality impact make this a meaningful data-exposure risk in multi-tenant or multi-organization YouTrack deployments.
Insecure Direct Object Reference in JetBrains YouTrack before version 2026.2.18634 permits authenticated users to access other users' private saved searches through the watchRules and issueListConfig API endpoints. The endpoints fail to enforce authorization checks on user-controlled object identifiers, allowing horizontal privilege escalation without elevated permissions. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Authorization bypass in JetBrains YouTrack's whiteboard feature allows authenticated read-only whiteboard users to modify canvas content they should only be able to view, by sending a crafted WebSocket message. Affected versions are all YouTrack releases before 2026.2.18634. The vulnerability stems from CWE-863 (Incorrect Authorization) - the server-side WebSocket handler fails to enforce the read-only permission boundary, accepting write operations from users who lack write privileges. No public exploit or active exploitation has been identified.
The generic VCS webhook handler in JetBrains YouTrack before 2026.2.18634 fails open when no webhook secret is configured, allowing unauthenticated remote callers to trigger webhook processing without any valid credential check. This CWE-306 flaw means that deployments where the webhook secret field is intentionally or inadvertently left blank accept all inbound webhook payloads as legitimate, bypassing the shared-secret verification mechanism. No public exploit code has been identified and the vulnerability is not in CISA KEV; the low CVSS score of 3.7 with AC:H accurately reflects that exploitation is constrained to misconfigured instances.
IP spoofing via forged HTTP headers in JetBrains YouTrack before 2026.2.18634 allows unauthenticated remote attackers to bypass Bitbucket webhook source validation, causing YouTrack to process attacker-crafted webhook payloads as if they originated from a legitimate Bitbucket server. The root cause is CWE-291 - reliance on IP address for authentication - specifically trusting client-controlled headers such as X-Forwarded-For to gate webhook acceptance. No public exploit has been identified at time of analysis, and JetBrains has released a patched build.
Stored XSS in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privilege users to inject AngularJS template expressions through issue assignee name fields, which are then evaluated as client-side JavaScript in the browsers of any user who views the affected issue or project board. The attack persists server-side, meaning every subsequent viewer triggers execution without further attacker interaction. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privileged users to inject persistent malicious scripts through custom field values displayed on Agile board cards. When a victim with an active YouTrack session views the affected Agile board, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code has been identified at time of analysis, and JetBrains has released a patched version.
Signed URL reuse in JetBrains YouTrack before 2026.2.18634 permits authenticated users to access restricted project icons they are not authorized to view. The flaw arises because signed URLs generated for project icon assets are not properly scoped or invalidated, allowing the same URL to be reused beyond its intended access context. No public exploit code has been identified and the vendor has issued a patch, making this a low-urgency but straightforward authorization control deficiency in a widely used issue tracker.
Denial-of-service in JetBrains YouTrack before versions 2026.1.13901 and 2026.2.17950 allows authenticated remote attackers to exhaust server resources by submitting crafted type parameters, rendering the service unavailable. The vulnerability stems from uncontrolled resource consumption (CWE-770), where malformed input is not bounded before processing. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized cross-project article disclosure in JetBrains YouTrack allows any authenticated user to read restricted knowledge base articles belonging to projects they are not authorized to access, by exploiting a missing authorization check on the draft creation endpoint. Affected are all YouTrack deployments running versions before 2026.1.13903 and 2026.2.17950. No public exploit or active exploitation has been identified, but the low attack complexity and network-accessible vector make this trivially repeatable by any valid account holder on the instance.
Denial-of-service in JetBrains YouTrack before 2026.2.18177 allows an authenticated low-privileged user to exhaust server resources by uploading a decompression bomb to the import endpoint. The CVSS vector confirms full availability impact (A:H) with no confidentiality or integrity consequences. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, making this a moderate-priority internal threat requiring authenticated access.
Account enumeration in JetBrains YouTrack before version 2026.2.18112 exposes internal user accounts to any authenticated user through insufficient authorization controls on the users search endpoint. The root cause is CWE-862 (Missing Authorization): the endpoint performs no privilege check beyond requiring a valid session, allowing low-privilege users to systematically extract account identifiers across the entire instance. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the straightforward exploitation path makes patching a clear priority.
Stored XSS in JetBrains YouTrack before 2026.2.17394 allows low-privileged authenticated users to inject malicious scripts into article titles, which are then rendered unsanitized within digest emails delivered to other users. When a recipient opens the digest email in an HTML-capable client and interacts with the affected content, the injected script executes in their browser context, enabling session token or credential theft. No public exploit or active exploitation has been identified; the CVSS score of 3.5 (Low) reflects the constrained impact due to required authentication, mandatory user interaction, and limited confidentiality-only impact.
CSS injection via Mermaid diagram rendering in JetBrains YouTrack before version 2026.2.17012 permits authenticated low-privilege users to embed malicious CSS into diagram content that executes in the browsers of other users who view the affected page. The CVSS score of 3.5 (Low) reflects the dual gating conditions of required authentication and victim interaction, substantially constraining real-world impact to UI manipulation rather than data exfiltration or code execution. No public exploit code or active exploitation has been identified at time of analysis.
Improper access control in JetBrains YouTrack before version 2026.2.16593 permits authenticated low-privileged users to read saved queries and tags outside their authorized scope. The flaw stems from missing authorization checks (CWE-862), meaning the application fails to verify whether the requesting user holds the required permissions before serving these resources over the network. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the network-accessible nature of the issue means any authenticated user on an exposed YouTrack instance is a potential threat actor.
Excessive user profile data disclosure in JetBrains YouTrack before 2026.2.16593 results from overly permissive default role configuration, allowing any authenticated low-privilege user to read more user profile attributes than intended. The root cause is CWE-276 (Incorrect Default Permissions), where the shipped default role grants broader read access to user directory data than the principle of least privilege requires. No public exploit or confirmed active exploitation exists at time of analysis.
Project settings disclosure in JetBrains YouTrack before version 2026.2.16593 allows an authenticated low-privileged user to read project configuration data they are not authorized to access via the MCP (Model Context Protocol) integration. The root cause is a missing authorization check (CWE-862) on MCP-exposed endpoints, meaning the server returns project settings without validating the requesting user's project-level permissions. No public exploit has been identified at time of analysis, no KEV listing exists, and a vendor-released patch is available.
Improper access control in JetBrains YouTrack before 2026.1.13570 permits any authenticated low-privileged user to enumerate restricted issues and articles through the Planning Canvas feature, exposing confidential project data they are not authorized to view. Rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), the flaw allows user-controlled identifiers to bypass access restrictions without proper authorization checks. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Improper access control in JetBrains YouTrack before version 2026.1.13570 permits any low-privileged authenticated user to modify service accounts, an administrative operation that should be restricted to privileged roles. Rooted in CWE-862 (Missing Authorization), the flaw is exploitable over the network with low complexity, requiring no user interaction - meaning any valid account holder on an exposed instance can tamper with service account configurations. No public exploit or CISA KEV listing has been identified at time of analysis, but the integrity impact is rated high given the sensitivity of service account access in YouTrack deployments.
Information disclosure in JetBrains YouTrack before version 2026.1.13162 allows authenticated low-privilege users to access sensitive user and group membership data they are not authorized to view. Rooted in CWE-863 (Incorrect Authorization), the flaw exists on the Users and Groups administrative pages, where authorization checks are insufficiently enforced for authenticated sessions. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the low access complexity means any authenticated attacker can reliably reproduce the condition.
Stored cross-site scripting in JetBrains YouTrack versions prior to 2026.1.13162 allows an authenticated project-level user to inject persistent JavaScript into project notification templates, which executes in the browsers of other users who receive or view those notifications. The scope-changed CVSS 8.7 reflects that injected scripts can pivot beyond the vulnerable component to compromise the sessions and data of higher-privileged recipients. No public exploit identified at time of analysis and no KEV listing, but the issue was disclosed and patched directly by the vendor.
Youtrack versions up to 2025.3.119033 is affected by insertion of sensitive information into log file (CVSS 6.5).
In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.