# CVE-2026-123329: JetBrains YouTrack missing authorization in TeamCity integration

Source: https://junglewise.ai/threats/cve-2026-123329-in-jetbrains-youtrack-before-2026-2-19562-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-123329 · Severity: medium · CVSS 5.4 · Published 2026-11-06

JetBrains YouTrack is a project management and issue-tracking tool used by development teams. A missing authorization check in its TeamCity integration allows attackers to view confidential actions and information from other projects they should not have access to, potentially exposing sensitive development data.

Technologies: [Jetbrains YouTrack](https://junglewise.ai/threats/technologies/youtrack). Vendors: [Jetbrains](https://junglewise.ai/threats/vendors/jetbrains).

## Quick answers

**Is CVE-2026-123329 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123329 being exploited in the wild.

**How severe is CVE-2026-123329?** Medium severity, with a CVSS score of 5.4, published 6 November 2026.

**Which products and versions are affected?** Jetbrains YouTrack before 2026.2.19562.

**Is there a fix for CVE-2026-123329?** Yes: fixed in YouTrack 2026.2.19562. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123329 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-123329?** Check whether you run Jetbrains YouTrack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in YouTrack 2026.2.19562

## Technical details

The vulnerability is a missing authorization control in the TeamCity integration component of YouTrack. An attacker can access the vulnerable endpoint to retrieve actions from projects outside their authorization scope. The flaw allows information disclosure without requiring authentication bypass or special privileges beyond basic access to YouTrack.

## Affected products

- JetBrains YouTrack before 2026.2.19562

## Timeline

- 2026-11-06: disclosed

## References

- [https://www.jetbrains.com/privacy-security/issues-fixed/](https://www.jetbrains.com/privacy-security/issues-fixed/)

## Related threats

- [JetBrains YouTrack missing authorization in VCS hosting configuration](https://junglewise.ai/threats/cve-2026-123332-in-jetbrains-youtrack-before-2026-2-19562-missing-authorization)
- [JetBrains YouTrack article visibility restriction bypass](https://junglewise.ai/threats/cve-2026-123331-in-jetbrains-youtrack-before-2026-2-19197-article-editors-could)
- [JetBrains YouTrack missing authorization in issue visibility settings](https://junglewise.ai/threats/cve-2026-123330-in-jetbrains-youtrack-before-2026-2-19562-missing-authorization)
- [JetBrains YouTrack app permission bypass privilege escalation](https://junglewise.ai/threats/cve-2026-123328-in-jetbrains-youtrack-before-2026-2-19656-app-permission-bypass)
- [JetBrains YouTrack authorization bypass in saved query endpoint](https://junglewise.ai/threats/cve-2026-123327-in-jetbrains-youtrack-before-2026-2-19562-missing-authorization)