Unauthorized Modification of Linked Entities via PUT Requests in JetBrains YouTrack

In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission

Exfiltration of Mailbox Credentials by Project Administrator in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials

Helpdesk Unauthorized Access Exposes Reporter Emails in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses

Unauthorized Creation of Knowledge Base Articles in Restricted Projects

In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects

YouTrack Whiteboard Clone Allows Unauthorized Issue Link Modification

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues

Improper Permission Checks Allow Read‑Only Users to Modify YouTrack Whiteboard Cards

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards

Cross‑Tenant Token Theft in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens

Stored Cross‑Site Scripting via Icon Uploads in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads

Improper permission checks allow overwriting of bundled apps via app import endpoint

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint

In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations

Private Saved Searches Exposed via watchRules and issueListConfig endpoints

In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches

Read‑Only Users Can Modify Canvas via Crafted WebSocket Message in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content

Blank Secret Leaves YouTrack VCS Webhook Handler Open

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank

IP Spoofing via HTTP Headers Allows Forged Bitbucket Webhooks in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks

Stored XSS via AngularJS Template Injection in JetBrains YouTrack Assignee Names

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS

Stored XSS via Custom Field on Agile Board Cards in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible

Signed URL Reuse Exposes Restricted Project Icons

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons

Authorization Bypass via IDOR in JetBrains YouTrack REST APIs

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR

Unauthenticated Account Takeover via Self‑Asserted Email Authentication in YouTrack Helpdesk

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address

In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible