Skip to contentJetbrains Youtrack vulnerabilities
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via...CVE-2026-1238503.5 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19656 users without update permission could change issue...CVE-2026-1233373.1 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI...CVE-2026-1233363.1 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562,
2026.1.14137,
2025.3.169041 missing authorization ...CVE-2026-1233353.5 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS...CVE-2026-1233343.8 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible...CVE-2026-1233333.8 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage...CVE-2026-1233324.7 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted...CVE-2026-1233315.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only...CVE-2026-1233305.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed...CVE-2026-1233295.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via...CVE-2026-1233286.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint...CVE-2026-1233277.5 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed...CVE-2026-1233267.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.170763,
2026.1.14150,
2026.2.19656 inclusion of untrusted...CVE-2026-1233257.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message...CVE-2026-1233247.7 High
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.170763,
2026.1.14150,
2026.2.19656 improper URL validation...CVE-2026-1233238.4 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19575
2026.3.16075
2026.3.16397
2026.3.16402 mail rules...CVE-2026-1110926.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integrationCVE-2026-1034975.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users'...CVE-2026-1034965.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation...CVE-2026-1034954.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group...CVE-2026-1034946.6 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possibleCVE-2026-1034938.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachmentsCVE-2026-1034926.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading...CVE-2026-1034916.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group linksCVE-2026-1034907.2 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was...CVE-2026-1034892.0 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to...CVE-2026-1034887.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template...CVE-2026-1002803.1 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentialsCVE-2026-1002796.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide...CVE-2026-1002784.9 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a...CVE-2026-1002778.9 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility...CVE-2026-1002765.9 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was...CVE-2026-1002756.9 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification...CVE-2026-1002746.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed...CVE-2026-1002738.2 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template...CVE-2026-1002724.9 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed...CVE-2026-1002712.7 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose...CVE-2026-1002703.3 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be...CVE-2026-1002694.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other...CVE-2026-1002687.7 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule...CVE-2026-1002675.9 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by...CVE-2026-1002642.7 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was...CVE-2026-1002634.7 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only...CVE-2026-1002627.6 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible...CVE-2026-1002615.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a...CVE-2026-1002605.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by...CVE-2026-1002594.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read...CVE-2026-1002584.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF...CVE-2026-1002574.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project...CVE-2026-865005.5 Medium
- Show olderLoading…