In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation

JetBrains YouTrack Application Permission Bypass Allowing Privilege Escalation via Project Tab

In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab

Untrusted Remote Code Inclusion via Plugin Sandbox Page in JetBrains YouTrack

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page

Information Disclosure via Shared Mailbox Message History in JetBrains YouTrack Before 2026.2.19562

In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible

Privilege Escalation via Unchecked Visibility Changes in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility

Attachment Size Limit Bypass via AI Assistant Thread Conversion in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion

Authorization flaw in JetBrains YouTrack scripts debugger enables script disclosure and suspension

In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension

In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions

Missing Authorization Enables Project Admin to Modify VCS Hosting Configurations

In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations

Authorization bypass allowing visibility changes in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings

Privilege Escalation via Deletion of Cross-Project VCS Integrations in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project

Missing Authorization Allows Arbitrary Tag Assignment in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection

In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints

YouTrack Article Visibility Bypass in Restricted Articles

In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles

YouTrack TeamCity Integration Authorization Flaw Exposes Project Actions

In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions

CSS Injection via Mermaid Diagram Configuration in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives

Cross-Project Command Execution via Mail Rules in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands

Missing Authorization Allows Self‑Add to Project Teams in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues

HTML Injection in VCS Command Failure Notifications in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible

Privileged Escalation via User Group Links in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links