Executive brief
JetBrains YouTrack is a project management and issue tracking platform used by development teams to organize work and collaborate. A flaw in the app import endpoint allowed attackers with insufficient privileges to overwrite bundled applications, potentially compromising the integrity of the platform and disrupting operations.
Technical details
The vulnerability stems from improper permission checks in the app import endpoint of JetBrains YouTrack. Attackers could bypass access controls to overwrite bundled applications, potentially replacing legitimate apps with malicious ones. The issue affected YouTrack versions before 2026.2.18634. The vulnerability requires access to the import endpoint but does not require authentication as a high-privilege user. Patches are available in YouTrack 2026.2.18634 and later versions.
Affected products
- JetBrains YouTrack before 2026.2.18634
Timeline
- 2026-09-07: disclosed