Jetbrains Youtrack vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Jetbrains Youtrack: 83 record(s), with affected versions and fixes.cpe:2.3:a:jetbrains:youtrack
CVE-2026-100264
Low · 2.7
CWE-522 Sep 30, 2026
Insufficiently Protected Credentials in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host
CVE-2026-100263
Medium · 6.1
CWE-79 Sep 30, 2026
Cross-site Scripting (XSS) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible
CVE-2026-100262
High · 7.1
CWE-863 Sep 30, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates
CVE-2026-100261
Medium · 5.4
CWE-288 Sep 30, 2026
Authentication Bypass Using an Alternate Path or Channel in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
CVE-2026-100260
Medium · 5.3
CWE-1188 Sep 30, 2026
Insecure Default Initialization of Resource in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
CVE-2026-100259
Medium · 4.3
CWE-863 Sep 30, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access
CVE-2026-100258
Medium · 4.3
CWE-201 Sep 30, 2026
Insertion of Sensitive Information Into Sent Data in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
CVE-2026-100257
Medium · 4.3
CWE-918 Sep 30, 2026
Server-Side Request Forgery (SSRF) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
CVE-2026-86500
Medium · 5.5
CWE-266 Sep 7, 2026
In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with…
In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin
CVE-2026-86499
Medium · 4.3
CWE-862 Sep 7, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission
CVE-2026-86498
High · 7.7
CWE-863 Sep 7, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.160480,
2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission
CVE-2026-86497
Medium · 6.8
CWE-201 Sep 7, 2026
Insertion of Sensitive Information Into Sent Data in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials
CVE-2026-86496
Medium · 4.3
CWE-862 Sep 7, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses
CVE-2026-86495
Medium · 6.5
CWE-862 Sep 7, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects
CVE-2026-86494
High · 7.7
CWE-862 Sep 7, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues
CVE-2026-86493
Medium · 6.5
CWE-863 Sep 7, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards
CVE-2026-86492
High · 8.5
CWE-488 Sep 7, 2026
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant…
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens
CVE-2026-86491
Low · 3.5
CWE-79 Sep 7, 2026
Cross-site Scripting (XSS) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads
CVE-2026-86490
Medium · 6.5
CWE-863 Sep 7, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint
CVE-2026-86489
Medium · 6.5
CWE-639 Sep 7, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations
CVE-2026-86488
Medium · 6.5
CWE-639 Sep 7, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches
CVE-2026-86487
Low · 3.1
CWE-863 Sep 7, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content
CVE-2026-86486
Low · 3.7
CWE-306 Sep 7, 2026
Missing Authentication for Critical Function in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank
CVE-2026-86485
Low · 3.3
CWE-291 Sep 7, 2026
In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged…
In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks
CVE-2026-86484
Medium · 4.6
CWE-79 Sep 7, 2026
Cross-site Scripting (XSS) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS