Jetbrains vulnerabilities
Published CVEs affecting Jetbrains products: 189 record(s), with severity, exploitation and fixes.
Youtrack 83Teamcity 44Intellij Idea 26Hub 10Pycharm 5Goland 5Webstorm 4Rider 2Phpstorm 2Resharper 2Datalore 2Dottrace 1Kotlin 1Exposed 1ReSharper, Rider and dotTrace 1Junie CLI 1Junie 1Ktor 1
CVE-2026-86503
Low · 3.3
CWE-918 Sep 7, 2026
Server-Side Request Forgery (SSRF) in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching
CVE-2026-86502
High · 8.4
CWE-306 Sep 7, 2026
Missing Authentication for Critical Function in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts
CVE-2026-86501
Low · 2.8
CWE-532 Sep 7, 2026
Insertion of Sensitive Information into Log File in Jetbrains Intellij Idea
In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log
CVE-2026-86500
Medium · 5.5
CWE-266 Sep 7, 2026
In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with…
In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin
CVE-2026-86499
Medium · 4.3
CWE-862 Sep 7, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission
CVE-2026-86498
High · 7.7
CWE-863 Sep 7, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.160480,
2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission
CVE-2026-86497
Medium · 6.8
CWE-201 Sep 7, 2026
Insertion of Sensitive Information Into Sent Data in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials
CVE-2026-86496
Medium · 4.3
CWE-862 Sep 7, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses
CVE-2026-86495
Medium · 6.5
CWE-862 Sep 7, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects
CVE-2026-86494
High · 7.7
CWE-862 Sep 7, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues
CVE-2026-86493
Medium · 6.5
CWE-863 Sep 7, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards
CVE-2026-86492
High · 8.5
CWE-488 Sep 7, 2026
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant…
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens
CVE-2026-86491
Low · 3.5
CWE-79 Sep 7, 2026
Cross-site Scripting (XSS) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads
CVE-2026-86490
Medium · 6.5
CWE-863 Sep 7, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint
CVE-2026-86489
Medium · 6.5
CWE-639 Sep 7, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations
CVE-2026-86488
Medium · 6.5
CWE-639 Sep 7, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches
CVE-2026-86487
Low · 3.1
CWE-863 Sep 7, 2026
Incorrect Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content
CVE-2026-86486
Low · 3.7
CWE-306 Sep 7, 2026
Missing Authentication for Critical Function in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank
CVE-2026-86485
Low · 3.3
CWE-291 Sep 7, 2026
In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged…
In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks
CVE-2026-86484
Medium · 4.6
CWE-79 Sep 7, 2026
Cross-site Scripting (XSS) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS
CVE-2026-86483
Medium · 5.4
CWE-79 Sep 7, 2026
Cross-site Scripting (XSS) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible
CVE-2026-86482
High · 8.8
CWE-266 Sep 7, 2026
In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments…
In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation
CVE-2026-86481
Medium · 4.3
CWE-639 Sep 7, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons
CVE-2026-86480
Critical · 9.8
CWE-306 Sep 7, 2026
Missing Authentication for Critical Function in Jetbrains Hub
In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges
CVE-2026-86479
High · 8.1
CWE-862 Sep 7, 2026
Missing Authorization in Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18788,
2026.1.14055,
2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR