Youtrack
This hub aggregates every CVE we track for Youtrack, a product in the devtools ci space. Use it to gauge the current risk picture and drill into individual advisories.
147
CVEs tracked
11
Critical
34
High
0
In CISA KEV
Severity distribution
MEDIUM87HIGH34LOW15CRITICAL11
Monthly trend
11
0
6
2
0
0
0
2
0
2
1
0
0
3
0
0
2
0
1
5
6
3
8
22
2024-102026-09
Latest CVEs
The 15 most recently published vulnerabilities affecting Youtrack.
- CVE-2026-86500In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin5.5
- CVE-2026-86499In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission4.3
- CVE-2026-86498In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission7.7
- CVE-2026-86496In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses4.3
- CVE-2026-86495In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects6.5
- CVE-2026-86497In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials6.8
- CVE-2026-86493In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards6.5
- CVE-2026-86494In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues7.7
- CVE-2026-86492In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens8.5
- CVE-2026-86489In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations6.5
- CVE-2026-86491In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads3.5
- CVE-2026-86490In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint6.5
- CVE-2026-86488In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches6.5
- CVE-2026-86487In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content3.1
- CVE-2026-86486In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank3.7
Product normalization is registry-driven with AI assist and human review. How it works