Jetbrains Youtrack vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Jetbrains Youtrack: 83 record(s), with affected versions and fixes.cpe:2.3:a:jetbrains:youtrack
CVE-2026-86483
Medium · 5.4
CWE-79 Sep 7, 2026
Cross-site Scripting (XSS) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible
CVE-2026-86482
High · 8.8
CWE-266 Sep 7, 2026
In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments…
In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation
CVE-2026-86481
Medium · 4.3
CWE-639 Sep 7, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons
CVE-2026-86479
High · 8.1
CWE-862 Sep 7, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18788,
2026.1.14055,
2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR
CVE-2026-86478
Critical · 9.8
CWE-290 Sep 7, 2026
Authentication Bypass by Spoofing in Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.161254,
2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address
CVE-2026-75051
High · 8.1
CWE-862 Aug 17, 2026
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was...
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
CVE-2026-75050
Medium · 6.5
CWE-770 Aug 17, 2026
In JetBrains YouTrack before 2026.1.13901,
2026.2.17950 doS attack was possible via crafted type...
In JetBrains YouTrack before 2026.1.13901,
2026.2.17950 doS attack was possible via crafted type parameters
CVE-2026-75049
Medium · 6.5
CWE-862 Aug 17, 2026
In JetBrains YouTrack before 2026.1.13903,
2026.2.17950 an authenticated user could read...
In JetBrains YouTrack before 2026.1.13903,
2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint
CVE-2026-75048
High · 8.2
CWE-79 Aug 17, 2026
In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was...
In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible
CVE-2026-75047
Medium · 6.5
CWE-409 Aug 17, 2026
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression…
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint
CVE-2026-75046
Medium · 4.3
CWE-862 Aug 17, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint
CVE-2026-75045
Critical · 9.1
CWE-288 Aug 17, 2026
Authentication Bypass Using an Alternate Path or Channel in Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.156085,
2026.1.13913,
2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
CVE-2026-75044
High · 8.1
CWE-862 Aug 17, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.156085,
2026.1.13914,
2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint
CVE-2026-62422
Critical · 9.8
CWE-306 Jul 14, 2026
In JetBrains YouTrack before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3...
In JetBrains YouTrack before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
CVE-2026-61492
Medium · 6.1
CWE-79 Jul 10, 2026
In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was...
In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible
CVE-2026-59791
Low · 3.5
CWE-1021 Jul 10, 2026
In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible
In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible
CVE-2026-57926
Critical · 9.8
CWE-1321 Jun 26, 2026
JetBrains YouTrack Prototype Pollution in websandbox Bridge
In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack
CVE-2026-57925
Medium · 5.3
CWE-862 Jun 26, 2026
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries...
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
CVE-2026-57924
Medium · 5.3
CWE-276 Jun 26, 2026
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user...
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
CVE-2026-57923
High · 7.5
CWE-862 Jun 26, 2026
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations...
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings
CVE-2026-57922
Medium · 5.3
CWE-862 Jun 26, 2026
In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
CVE-2026-57921
High · 7.5
CWE-862 Jun 26, 2026
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private...
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint
CVE-2026-49386
Medium · 6.5
CWE-639 May 29, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas
CVE-2026-49385
Medium · 6.5
CWE-862 May 29, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts
CVE-2026-49370
High · 7.5
CWE-201 May 29, 2026
Insertion of Sensitive Information Into Sent Data in Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests