Vulnerabilidades do Jetbrains Youtrack

CVE-2026-111092 Média · 6.5 CWE-862 15/10/2026

In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules...

In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands

CVE-2026-103497 Média · 5.5 CWE-918 01/10/2026

Server-Side Request Forgery (SSRF) em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration

CVE-2026-103496 Média · 5.4 CWE-639 01/10/2026

Authorization Bypass Through User-Controlled Key (IDOR) em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

CVE-2026-103495 Média · 4.3 CWE-862 01/10/2026

Missing Authorization em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

CVE-2026-103494 Média · 6.6 CWE-266 01/10/2026

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user…

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes

CVE-2026-103493 Alta · 8.1 CWE-79 01/10/2026

Cross-site Scripting (XSS) em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible

CVE-2026-103492 Média · 6.5 CWE-835 01/10/2026

Infinite Loop em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments

CVE-2026-103491 Média · 6.5 CWE-639 01/10/2026

Authorization Bypass Through User-Controlled Key (IDOR) em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

CVE-2026-103490 Alta · 7.2 CWE-862 01/10/2026

Missing Authorization em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links

CVE-2026-103489 Média · 5.4 CWE-79 01/10/2026

Cross-site Scripting (XSS) em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible

CVE-2026-103488 Alta · 7.1 CWE-863 01/10/2026

Incorrect Authorization em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues

CVE-2026-100280 Média · 4.3 CWE-862 30/09/2026

Missing Authorization em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible

CVE-2026-100279 Média · 6.5 CWE-918 30/09/2026

Server-Side Request Forgery (SSRF) em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials

CVE-2026-100278 Média · 4.9 CWE-863 30/09/2026

Incorrect Authorization em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments

CVE-2026-100277 Crítica · 9.8 CWE-863 30/09/2026

Incorrect Authorization em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature

CVE-2026-100276 Alta · 7.5 CWE-863 30/09/2026

Incorrect Authorization em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action

CVE-2026-100275 Média · 4.8 CWE-79 30/09/2026

Cross-site Scripting (XSS) em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible

CVE-2026-100274 Média · 6.5 CWE-770 30/09/2026

Allocation of Resources Without Limits or Throttling em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template

CVE-2026-100273 Crítica · 9.8 CWE-863 30/09/2026

Incorrect Authorization em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution

CVE-2026-100272 Média · 4.9 CWE-639 30/09/2026

Authorization Bypass Through User-Controlled Key (IDOR) em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues

CVE-2026-100271 Baixa · 2.7 CWE-862 30/09/2026

Missing Authorization em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects

CVE-2026-100270 Baixa · 2.7 CWE-863 30/09/2026

Incorrect Authorization em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations

CVE-2026-100269 Média · 4.3 CWE-862 30/09/2026

Missing Authorization em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed

CVE-2026-100268 Baixa · 2.7 CWE-639 30/09/2026

Authorization Bypass Through User-Controlled Key (IDOR) em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates

CVE-2026-100267 Média · 5.9 CWE-1333 30/09/2026

Inefficient Regular Expression Complexity (ReDoS) em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters