YouTrack SSRF via Stored X‑HTML Injection in PDF Export

In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export

Missing Authorization Allows Read-Only Users to View Project Settings in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings

YouTrack Gantt Chart Improper Access Control Allows Edits by View‑Only Users

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access

Authentication after Password Reset via Mailbox Integration in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset

Unauthorized Article Visibility Modification in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

Authorization Bypass Allowing Read‑Only Users to Modify Project Notification Templates

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates

HTML Injection via User‑Agent Header in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

SMTP Credentials Disclosure via Host Change in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host

YouTrack Integration Credentials Disclosure via Import Configurations

In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations

Authenticated Users Gain Unauthorized Access to Data from Other Projects

In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects

Missing Authorization in YouTrack Notification Template Preview Exposes Restricted Issues

In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues

Authorization Bypass Allowing Arbitrary Code Execution in JetBrains YouTrack Scripts Debugger

In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution

In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template

Guest users able to bypass workflow visibility restrictions in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action

Account Takeover via Replay of Notification Signature in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature

Privilege Escalation Allowing Comment Modification in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments

Credential Exposure via Integration URL Modification in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials

Unintended Project Creation via Unreadable Custom Template in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible

Stored XSS in JetBrains YouTrack Workflow Error Notification Toast

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible

Stored XSS via Mermaid and LaTeX in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible