CSS Injection via Mermaid Diagrams in YouTrack

In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible

Stored XSS via article titles in digest emails in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible

Improper Authorization in YouTrack Project Configuration Endpoint

In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings

Excessive User Profile Data Exposure through Default Role Configuration

In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details

Improper Access Control Allows Read Access to Saved Queries and Tags

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags

Prototype Pollution in JetBrains YouTrack Websandbox Bridge Before 2026.2.16593

In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack

Improper Access Control in JetBrains YouTrack Exposes User Private Data via Comment Templates Endpoint

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint

YouTrack Project Settings Disclosure via MCP

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible

Stored Cross‑Site Scripting in JetBrains YouTrack Notification Templates

In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible

Information Disclosure on Users and Groups Pages in JetBrains YouTrack

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages

YouTrack Information Disclosure via fetchApp Requests

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

Access Control Bypass in JetBrains YouTrack

In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts

Improper Access Control Allowing Enumeration of Restricted Content on Planning Canvas

In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas

High Privileged User Remote Code Execution via Sandbox Bypass in JetBrains YouTrack

In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass

YouTrack Access Tokens Exposed in Mailbox Logs

In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs

Unauthorized Access to App Permissions in JetBrains YouTrack

In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint

In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure

In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it relates to internal functionality that is not available to customers.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it relates to internal functionality that is not available to customers.