# CVE-2026-123328: JetBrains YouTrack app permission bypass privilege escalation

Source: https://junglewise.ai/threats/cve-2026-123328-in-jetbrains-youtrack-before-2026-2-19656-app-permission-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-123328 · Severity: medium · CVSS 6.4 · Published 2026-11-06

JetBrains YouTrack is a project management and issue tracking system used by development teams. A permission bypass vulnerability in the project tab allowed users with lower privileges to escalate to higher privileges through app permissions, potentially gaining unauthorized access to sensitive project data or administrative functions.

Technologies: [Jetbrains YouTrack](https://junglewise.ai/threats/technologies/youtrack). Vendors: [Jetbrains](https://junglewise.ai/threats/vendors/jetbrains).

## Quick answers

**Is CVE-2026-123328 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123328 being exploited in the wild.

**How severe is CVE-2026-123328?** Medium severity, with a CVSS score of 6.4, published 6 November 2026.

**Which products and versions are affected?** Jetbrains YouTrack before 2026.2.19656.

**Is there a fix for CVE-2026-123328?** Yes: fixed in YouTrack 2026.2.19656. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123328 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-123328?** Check whether you run Jetbrains YouTrack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in YouTrack 2026.2.19656

## Technical details

An app permission bypass vulnerability in JetBrains YouTrack allows privilege escalation via the project tab. The vulnerability affects the permission model for app-based access, enabling attackers to bypass intended restrictions and gain elevated access without proper authorization.

## Affected products

- JetBrains YouTrack before 2026.2.19656

## Timeline

- 2026-11-06: advisory

## References

- [https://www.jetbrains.com/privacy-security/issues-fixed/](https://www.jetbrains.com/privacy-security/issues-fixed/)

## Related threats

- [JetBrains YouTrack missing authorization in VCS hosting configuration](https://junglewise.ai/threats/cve-2026-123332-in-jetbrains-youtrack-before-2026-2-19562-missing-authorization)
- [JetBrains YouTrack article visibility restriction bypass](https://junglewise.ai/threats/cve-2026-123331-in-jetbrains-youtrack-before-2026-2-19197-article-editors-could)
- [JetBrains YouTrack missing authorization in issue visibility settings](https://junglewise.ai/threats/cve-2026-123330-in-jetbrains-youtrack-before-2026-2-19562-missing-authorization)
- [JetBrains YouTrack missing authorization in TeamCity integration](https://junglewise.ai/threats/cve-2026-123329-in-jetbrains-youtrack-before-2026-2-19562-missing-authorization)
- [JetBrains YouTrack authorization bypass in saved query endpoint](https://junglewise.ai/threats/cve-2026-123327-in-jetbrains-youtrack-before-2026-2-19562-missing-authorization)