Vulnerabilidades do Jetbrains Youtrack
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Jetbrains Youtrack: 83 registro(s), com versões afetadas e correções.cpe:2.3:a:jetbrains:youtrack
CVE-2026-86483
Média · 5.4
CWE-79 07/09/2026
Cross-site Scripting (XSS) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible
CVE-2026-86482
Alta · 8.8
CWE-266 07/09/2026
In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments…
In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation
CVE-2026-86481
Média · 4.3
CWE-639 07/09/2026
Authorization Bypass Through User-Controlled Key (IDOR) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons
CVE-2026-86479
Alta · 8.1
CWE-862 07/09/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18788,
2026.1.14055,
2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR
CVE-2026-86478
Crítica · 9.8
CWE-290 07/09/2026
Authentication Bypass by Spoofing em Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.161254,
2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address
CVE-2026-75051
Alta · 8.1
CWE-862 17/08/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
CVE-2026-75050
Média · 6.5
CWE-770 17/08/2026
Allocation of Resources Without Limits or Throttling em Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13901,
2026.2.17950 doS attack was possible via crafted type parameters
CVE-2026-75049
Média · 6.5
CWE-862 17/08/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13903,
2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint
CVE-2026-75048
Alta · 8.2
CWE-79 17/08/2026
Cross-site Scripting (XSS) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible
CVE-2026-75047
Média · 6.5
CWE-409 17/08/2026
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression…
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint
CVE-2026-75046
Média · 4.3
CWE-862 17/08/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint
CVE-2026-75045
Crítica · 9.1
CWE-288 17/08/2026
Authentication Bypass Using an Alternate Path or Channel em Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.156085,
2026.1.13913,
2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
CVE-2026-75044
Alta · 8.1
CWE-862 17/08/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2025.3.156085,
2026.1.13914,
2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint
CVE-2026-62422
Crítica · 9.8
CWE-306 14/07/2026
Missing Authentication for Critical Function em Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.148120,
2024.3.148430,
2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
CVE-2026-61492
Média · 6.1
CWE-79 10/07/2026
Cross-site Scripting (XSS) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible
CVE-2026-59791
Baixa · 3.5
CWE-1021 10/07/2026
Clickjacking em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible
CVE-2026-57926
Crítica · 9.8
CWE-1321 26/06/2026
Prototype Pollution na ponte websandbox do JetBrains YouTrack
Na JetBrains YouTrack anterior à versão 2026.2.16593, a ponte websandbox era vulnerável a um ataque de prototype pollution
CVE-2026-57925
Média · 5.3
CWE-862 26/06/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
CVE-2026-57924
Média · 5.3
CWE-276 26/06/2026
Incorrect Default Permissions em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
CVE-2026-57923
Alta · 7.5
CWE-862 26/06/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings
CVE-2026-57922
Média · 5.3
CWE-862 26/06/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
CVE-2026-57921
Alta · 7.5
CWE-862 26/06/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint
CVE-2026-49386
Média · 6.5
CWE-639 29/05/2026
Authorization Bypass Through User-Controlled Key (IDOR) em Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas
CVE-2026-49385
Média · 6.5
CWE-862 29/05/2026
Missing Authorization em Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts
CVE-2026-49370
Alta · 7.5
CWE-201 29/05/2026
Insertion of Sensitive Information Into Sent Data em Jetbrains Youtrack
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests