Youtrack (Jetbrains) - vulnerabilities (CVEs)

157 CVEs, 33 in the last 30 days, 343 known versions, newest CVE from 2026-10-15. Vendor: Jetbrains.

CVEs of Youtrack

• CVE-2026-111092 - CVSS 6.5 (medium), 2026-10-15: In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands
• CVE-2026-103497 - CVSS 5.5 (medium), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
• CVE-2026-103496 - CVSS 5.4 (medium), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
• CVE-2026-103494 - CVSS 6.6 (medium), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes
• CVE-2026-103493 - CVSS 8.1 (high), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
• CVE-2026-103495 - CVSS 4.3 (medium), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
• CVE-2026-103492 - CVSS 6.5 (medium), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments
• CVE-2026-103491 - CVSS 6.5 (medium), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
• CVE-2026-103490 - CVSS 7.2 (high), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
• CVE-2026-103489 - CVSS 5.4 (medium), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible
• CVE-2026-103488 - CVSS 7.1 (high), 2026-10-01: In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues
• CVE-2026-100280 - CVSS 4.3 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
• CVE-2026-100277 - CVSS 9.8 (critical), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
• CVE-2026-100279 - CVSS 6.5 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
• CVE-2026-100278 - CVSS 4.9 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
• CVE-2026-100276 - CVSS 7.5 (high), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
• CVE-2026-100275 - CVSS 6.9 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
• CVE-2026-100274 - CVSS 6.5 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
• CVE-2026-100273 - CVSS 9.8 (critical), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
• CVE-2026-100271 - CVSS 2.7 (low), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects
• CVE-2026-100270 - CVSS 3.3 (low), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations
• CVE-2026-100272 - CVSS 4.9 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
• CVE-2026-100268 - CVSS 7.7 (high), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates
• CVE-2026-100267 - CVSS 5.9 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
• CVE-2026-100269 - CVSS 4.3 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
• CVE-2026-100264 - CVSS 2.7 (low), 2026-09-30: In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host
• CVE-2026-100262 - CVSS 7.6 (high), 2026-09-30: In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates
• CVE-2026-100263 - CVSS 6.1 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible
• CVE-2026-100259 - CVSS 4.3 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access
• CVE-2026-100261 - CVSS 5.4 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
• CVE-2026-100260 - CVSS 5.3 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
• CVE-2026-100258 - CVSS 4.3 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
• CVE-2026-100257 - CVSS 4.3 (medium), 2026-09-30: In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
• CVE-2026-86500 - CVSS 5.5 (medium), 2026-09-07: In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin
• CVE-2026-86499 - CVSS 4.3 (medium), 2026-09-07: In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission
• CVE-2026-86498 - CVSS 7.7 (high), 2026-09-07: In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission
• CVE-2026-86497 - CVSS 6.8 (medium), 2026-09-07: In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox…
• CVE-2026-86496 - CVSS 4.3 (medium), 2026-09-07: In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses
• CVE-2026-86495 - CVSS 6.5 (medium), 2026-09-07: In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects
• CVE-2026-86494 - CVSS 7.7 (high), 2026-09-07: In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues
• CVE-2026-86493 - CVSS 6.5 (medium), 2026-09-07: In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards
• CVE-2026-86492 - CVSS 8.5 (high), 2026-09-07: In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens
• CVE-2026-86490 - CVSS 6.5 (medium), 2026-09-07: In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint
• CVE-2026-86489 - CVSS 6.5 (medium), 2026-09-07: In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations
• CVE-2026-86491 - CVSS 3.5 (low), 2026-09-07: In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads
• CVE-2026-86487 - CVSS 3.1 (low), 2026-09-07: In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content
• CVE-2026-86488 - CVSS 6.5 (medium), 2026-09-07: In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches
• CVE-2026-86484 - CVSS 4.6 (medium), 2026-09-07: In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS
• CVE-2026-86486 - CVSS 3.7 (low), 2026-09-07: In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank
• CVE-2026-86485 - CVSS 3.5 (low), 2026-09-07: In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks
• CVE-2026-86483 - CVSS 5.4 (medium), 2026-09-07: In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible
• CVE-2026-86482 - CVSS 8.8 (high), 2026-09-07: In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation
• CVE-2026-86481 - CVSS 4.3 (medium), 2026-09-07: In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons
• CVE-2026-86479 - CVSS 8.1 (high), 2026-09-07: In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR
• CVE-2026-86478 - CVSS 9.8 (critical), 2026-09-07: In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a…
• CVE-2026-75051 - CVSS 8.1 (high), 2026-08-17: In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
• CVE-2026-75050 - CVSS 7.1 (high), 2026-08-17: In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters
• CVE-2026-75049 - CVSS 6.5 (medium), 2026-08-17: In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint
• CVE-2026-75048 - CVSS 8.2 (high), 2026-08-17: In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible
• CVE-2026-75047 - CVSS 6.5 (medium), 2026-08-17: In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint
• CVE-2026-75046 - CVSS 4.3 (medium), 2026-08-17: In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint
• CVE-2026-75044 - CVSS 8.1 (high), 2026-08-17: In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via…
• CVE-2026-75045 - CVSS 9.1 (critical), 2026-08-17: In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
• CVE-2026-62422 - CVSS 10 (critical), 2026-07-14: In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database…
• CVE-2026-61492 - CVSS 6.1 (medium), 2026-07-10: In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible
• CVE-2026-59791 - CVSS 3.5 (low), 2026-07-10: In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible
• CVE-2026-57926 - CVSS 9.8 (critical), 2026-06-26: In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack
• CVE-2026-57925 - CVSS 5.3 (medium), 2026-06-26: In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
• CVE-2026-57924 - CVSS 5.3 (medium), 2026-06-26: In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
• CVE-2026-57923 - CVSS 7.5 (high), 2026-06-26: In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings
• CVE-2026-57921 - CVSS 7.5 (high), 2026-06-26: In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint
• CVE-2026-57922 - CVSS 5.3 (medium), 2026-06-26: In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
• CVE-2026-49386 - CVSS 6.5 (medium), 2026-05-29: In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas
• CVE-2026-49385 - CVSS 6.5 (medium), 2026-05-29: In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts
• CVE-2026-49369 - CVSS 4.3 (medium), 2026-05-29: In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages
• CVE-2026-49368 - CVSS 8.7 (high), 2026-05-29: In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
• CVE-2026-49370 - CVSS 7.5 (high), 2026-05-29: In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests
• CVE-2026-33392 - CVSS 7.2 (high), 2026-04-17: In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass
• CVE-2026-28193 - CVSS 8.8 (high), 2026-02-25: In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint
• CVE-2026-25846 - CVSS 6.5 (medium), 2026-02-09: In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs
• CVE-2025-64773 - CVSS 3.7 (low), 2025-11-11: In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit
• CVE-2025-64685 - CVSS 8.1 (high), 2025-11-10: In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure
• CVE-2025-64684 - CVSS 7.5 (high), 2025-11-10: In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form
• CVE-2025-57731 - CVSS 8.7 (high), 2025-08-20: In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content
• CVE-2025-54527 - CVSS 6.1 (medium), 2025-07-28: In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass…
• CVE-2025-53959 - CVSS 7.6 (high), 2025-07-15: In JetBrains YouTrack before 2025.2.86069, 2024.3.85077, 2025.1.86199 email spoofing via an administrative API was possible
• CVE-2025-48391 - CVSS 7.7 (high), 2025-05-20: In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API
• CVE-2025-47850 - CVSS 5.3 (medium), 2025-05-20: In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning
• CVE-2025-24458 - CVSS 7.8 (high), 2025-01-21: In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration
• CVE-2025-24457 - CVSS 5.5 (medium), 2025-01-21: In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs
• CVE-2024-54154 - CVSS 9.8 (critical), 2024-12-04: In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox
• CVE-2024-54157 - CVSS 6.5 (medium), 2024-12-04: In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector
• CVE-2024-54156 - CVSS 6.5 (medium), 2024-12-04: In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack
• CVE-2024-54155 - CVSS 5.3 (medium), 2024-12-04: In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication
• CVE-2024-54158 - CVSS 5.3 (medium), 2024-12-04: In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding
• CVE-2024-54153 - CVSS 6.5 (medium), 2024-12-04: In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter
• CVE-2024-50578 - CVSS 5.4 (medium), 2024-10-28: In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page
• CVE-2024-50581 - CVSS 5.4 (medium), 2024-10-28: In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag
• CVE-2024-50580 - CVSS 5.4 (medium), 2024-10-28: In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule
• CVE-2024-50579 - CVSS 6.1 (medium), 2024-10-28: In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possible