Unauthorized Article Visibility Modification in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

Authorization Bypass Allowing Read‑Only Users to Modify Project Notification Templates

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates

HTML Injection via User‑Agent Header in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

SMTP Credentials Disclosure via Host Change in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host

In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation

Unauthorized Email Sending via Trusted Address

In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address

YouTrack Integration Credentials Disclosure via Import Configurations

In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations

Authenticated Users Gain Unauthorized Access to Data from Other Projects

In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects

Missing Authorization in YouTrack Notification Template Preview Exposes Restricted Issues

In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues

Authorization Bypass Allowing Arbitrary Code Execution in JetBrains YouTrack Scripts Debugger

In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution

In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template

Guest users able to bypass workflow visibility restrictions in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action

Account Takeover via Replay of Notification Signature in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature

Privilege Escalation Allowing Comment Modification in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments

Credential Exposure via Integration URL Modification in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials

Unintended Project Creation via Unreadable Custom Template in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible

Stored XSS in JetBrains YouTrack Workflow Error Notification Toast

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible

Stored XSS via Mermaid and LaTeX in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible

Unauthorized By-pass of Helpdesk Authorized Reporters in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed

Project Administrator Information Disclosure via Notification Templates

In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates