# CVE-2026-49368: JetBrains YouTrack stored XSS in project notification templates

Source: https://junglewise.ai/threats/cve-2026-49368-jetbrains-youtrack-stored-xss-in-project-notification-templates  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-49368 · Severity: high · CVSS 8.7 · Published 2026-05-29

JetBrains YouTrack, a project management and issue tracking tool, was vulnerable to a security flaw in its notification template system. An attacker with basic user permissions could inject malicious scripts that would execute in the browsers of other users, including administrators. This could lead to unauthorized access to sensitive project data, session hijacking, or the performance of actions on behalf of other users.

Technologies: [Jetbrains YouTrack](https://junglewise.ai/threats/technologies/youtrack). Vendors: [Jetbrains](https://junglewise.ai/threats/vendors/jetbrains).

## Quick answers

**Is CVE-2026-49368 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49368 being exploited in the wild.

**How severe is CVE-2026-49368?** High severity, with a CVSS score of 8.7, published 29 May 2026.

**Which products and versions are affected?** Jetbrains YouTrack before 2026.1.13162.

**Is there a fix for CVE-2026-49368?** A patch was published on 2026-05-29: Fixed in version 2026.1.13162 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49368 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49368?** Check whether you run Jetbrains YouTrack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability (CWE-79) existed in JetBrains YouTrack before version 2026.1.13162. The flaw was located in the project notification templates component, where input was not properly neutralized before being rendered in the web interface. An authenticated attacker with low privileges could inject malicious scripts into these templates. When other users, such as project managers or administrators, view or interact with these notifications, the script executes in their browser context. This can lead to full session compromise or unauthorized data exfiltration. The issue has been addressed in version 2026.1.13162.

## Affected products

- JetBrains YouTrack before 2026.1.13162

## Timeline

- 2026-05-29: advisory: CVE-2026-49368 published by JetBrains
- 2026-05-29: patched: Fixed in version 2026.1.13162

## References

- [https://www.jetbrains.com/privacy-security/issues-fixed/](https://www.jetbrains.com/privacy-security/issues-fixed/)

## Related threats

- [JetBrains YouTrack missing authorization in VCS hosting configuration](https://junglewise.ai/threats/cve-2026-123332-in-jetbrains-youtrack-before-2026-2-19562-missing-authorization)
- [JetBrains YouTrack article visibility restriction bypass](https://junglewise.ai/threats/cve-2026-123331-in-jetbrains-youtrack-before-2026-2-19197-article-editors-could)
- [JetBrains YouTrack missing authorization in issue visibility settings](https://junglewise.ai/threats/cve-2026-123330-in-jetbrains-youtrack-before-2026-2-19562-missing-authorization)
- [JetBrains YouTrack missing authorization in TeamCity integration](https://junglewise.ai/threats/cve-2026-123329-in-jetbrains-youtrack-before-2026-2-19562-missing-authorization)
- [JetBrains YouTrack app permission bypass privilege escalation](https://junglewise.ai/threats/cve-2026-123328-in-jetbrains-youtrack-before-2026-2-19656-app-permission-bypass)