Jetbrains
Jetbrains Youtrack: vulnerabilities and CVEs
Jetbrains Youtrack has 179 published vulnerabilities, 82 of them in the last 12 months. 15 are rated critical and 0 are listed by CISA as actively exploited.
CVEs179
Last 12 months82
Critical15
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-103497 | Medium (5.5) | 0.15% | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration |
| CVE-2026-103496 | Medium (5.4) | 0.14% | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications |
| CVE-2026-103495 | Medium (4.3) | 0.19% | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs |
| CVE-2026-103494 | Medium (6.6) | 0.21% | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes |
| CVE-2026-103493 | High (8.1) | 0.22% | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible |
| CVE-2026-103492 | Medium (6.5) | 0.68% | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments |
| CVE-2026-103491 | Medium (6.5) | 0.20% | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues |
| CVE-2026-103490 | High (7.2) | 0.43% | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links |
| CVE-2026-103489 | Low (2) | 0.14% | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible |
| CVE-2026-103488 | High (7.1) | 0.28% | — | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues |
| CVE-2026-100280 | Medium (4.3) | 0.17% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible |
| CVE-2026-100279 | Medium (6.5) | 0.25% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials |
| CVE-2026-100278 | Medium (4.9) | 0.24% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments |
| CVE-2026-100277 | Critical (9.8) | 0.28% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature |
| CVE-2026-100276 | High (7.5) | 0.22% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action |
| CVE-2026-100275 | Medium (4.8) | 0.19% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible |
| CVE-2026-100274 | Medium (6.5) | 0.84% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template |
| CVE-2026-100273 | Critical (9.8) | 0.30% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution |
| CVE-2026-100272 | Medium (4.9) | 0.29% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues |
| CVE-2026-100271 | Low (2.7) | 0.23% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects |
| CVE-2026-100270 | Low (2.7) | 0.17% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations |
| CVE-2026-100269 | Medium (4.3) | 0.20% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed |
| CVE-2026-100268 | Low (2.7) | 0.23% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates |
| CVE-2026-100267 | Medium (5.9) | 0.29% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters |
| CVE-2026-100264 | Low (2.7) | 0.23% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host |
| CVE-2026-100263 | Medium (6.1) | 0.19% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible |
| CVE-2026-100262 | High (7.1) | 0.21% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates |
| CVE-2026-100261 | Medium (5.4) | 0.18% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission |
| CVE-2026-100260 | Medium (5.3) | 0.27% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset |
| CVE-2026-100259 | Medium (4.3) | 0.19% | — | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access |
🎯 How it gets exploited (ATT&CK techniques)
Number of CVEs of this technology mapped to each exploitation or primary-impact technique.