Technology · Jetbrains
Jetbrains YouTrack vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 83 vulnerabilities in Jetbrains YouTrack: 10 in the last 7 days and 67 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123332, was published on 6 November 2026. 10 vulnerabilities in the last four weeks, down 64% on the four before (28).
- Last 7 days
- 10
- Last 90 days
- 67
- Critical, all time
- 2
- Exploited in the wild
- 0
About Jetbrains YouTrack
YouTrack is a browser-based project management tool and issue tracker.
Latest Jetbrains YouTrack vulnerabilities
- CVE-2026-123332: JetBrains YouTrack missing authorization in VCS hosting configurationmediumCVSS 4.7
- CVE-2026-123331: JetBrains YouTrack article visibility restriction bypassmediumCVSS 5.4
- CVE-2026-123330: JetBrains YouTrack missing authorization in issue visibility settingsmediumCVSS 5.4
- CVE-2026-123329: JetBrains YouTrack missing authorization in TeamCity integrationmediumCVSS 5.4
- CVE-2026-123328: JetBrains YouTrack app permission bypass privilege escalationmediumCVSS 6.4
- CVE-2026-123327: JetBrains YouTrack authorization bypass in saved query endpointhighCVSS 7.5
- CVE-2026-123326: JetBrains YouTrack scripts debugger authorization bypasshighCVSS 7.1
- CVE-2026-123325: JetBrains YouTrack remote code inclusion via plugin sandboxhighCVSS 7.1
- CVE-2026-123324: JetBrains YouTrack information disclosure in shared mailbox message historyhighCVSS 7.7
- CVE-2026-123323: JetBrains YouTrack improper URL validation in app widget hosthighCVSS 8.4
- CVE-2026-103497: JetBrains YouTrack server-side request forgery in GitHub VCS integrationmediumCVSS 5.5EPSS 0.1%
- CVE-2026-103496: JetBrains YouTrack insecure direct object reference in inbox threadsmediumCVSS 5.4EPSS 0.1%
- CVE-2026-103495: JetBrains YouTrack missing authorization in translation catalog reloadmediumCVSS 4.3EPSS 0.2%
- CVE-2026-103494: JetBrains YouTrack privilege escalation via group membership changesmediumCVSS 6.6EPSS 0.2%
- CVE-2026-103493: JetBrains YouTrack stored XSS in Mermaid and LaTeXhighCVSS 8.1EPSS 0.2%
- CVE-2026-103492: JetBrains YouTrack denial of service via crafted PSD attachmentsmediumCVSS 6.5EPSS 0.7%
- CVE-2026-103491: JetBrains YouTrack insecure direct object reference in issue activities APImediumCVSS 6.5EPSS 0.2%
- CVE-2026-103490: JetBrains YouTrack privilege escalation via user group linkshighCVSS 7.2EPSS 0.4%
- CVE-2026-103489: In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possiblelowCVSS 2EPSS 0.1%
- CVE-2026-103488: JetBrains YouTrack missing authorization in project teamshighCVSS 7.1EPSS 0.3%
- CVE-2026-100279: JetBrains YouTrack credential exposure in integration URL changemediumCVSS 6.5EPSS 0.3%
- CVE-2026-100278: JetBrains YouTrack privilege escalation in comment managementmediumCVSS 4.9
- CVE-2026-100277: JetBrains YouTrack notification signature replay leading to account takeoverhighCVSS 8.9
- CVE-2026-100276: JetBrains YouTrack privilege escalation in workflow actionsmediumCVSS 5.9
- CVE-2026-100275: JetBrains YouTrack stored XSS in workflow error notificationmediumCVSS 6.9
Most severe Jetbrains YouTrack vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-62422: JetBrains YouTrack authentication bypass via direct database accesscriticalCVSS 10
- CVE-2026-75045: JetBrains YouTrack unauthenticated database backup downloadcriticalCVSS 9.1EPSS 0.4%
- CVE-2026-100277: JetBrains YouTrack notification signature replay leading to account takeoverhighCVSS 8.9
- CVE-2026-86482: JetBrains YouTrack privilege escalation in role assignment validationhighCVSS 8.8EPSS 0.4%
- CVE-2026-49368: JetBrains YouTrack stored XSS in project notification templateshighCVSS 8.7
- CVE-2026-86492: JetBrains YouTrack cross-tenant GitHub App token thefthighCVSS 8.5EPSS 0.9%
- CVE-2026-123323: JetBrains YouTrack improper URL validation in app widget hosthighCVSS 8.4
- CVE-2026-75048: JetBrains YouTrack stored XSS in fenced code-block language labelhighCVSS 8.2EPSS 0.3%
- CVE-2026-100273: JetBrains YouTrack authorization bypass in scripts debuggerhighCVSS 8.2
- CVE-2026-75044: JetBrains YouTrack missing authorization in mailbox endpointhighCVSS 8.1EPSS 0.4%
Vulnerabilities per week
10 vulnerabilities in the last four weeks, down 64% on the four before (28). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 8 | 1 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 21 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 28 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 10 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Jetbrains YouTrack vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/youtrack)<a href="https://junglewise.ai/threats/technologies/youtrack"><img src="https://junglewise.ai/threats/technologies/youtrack/badge.svg" alt="Jetbrains YouTrack vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/youtrack.json, and this page as text at https://junglewise.ai/threats/technologies/youtrack.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Jetbrains YouTrack vulnerabilities", https://junglewise.ai/threats/technologies/youtrack, 12 November 2026.