JetBrains You Track: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 22

• Critical 9.8
  CVE-2026-86478 Public exploit

  In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthent…

  JetBrains YouTrack
  Sep 7, 2026
• High 8.8
  CVE-2026-86482

  In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation

  JetBrains YouTrack
  Sep 7, 2026
• High 8.5
  CVE-2026-86492

  In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation to…

  JetBrains YouTrack
  Sep 7, 2026
• High 8.0
  CVE-2026-86479

  In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restrict…

  JetBrains YouTrack
  Sep 7, 2026
• High 7.7
  CVE-2026-86494

  In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible is…

  JetBrains YouTrack
  Sep 7, 2026
• High 7.7
  CVE-2026-86498

  In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked…

  JetBrains YouTrack
  Sep 7, 2026
• Medium 6.8
  CVE-2026-86497

  In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administr…

  JetBrains YouTrack
  Sep 7, 2026
• Medium 6.5
  CVE-2026-86488

  In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved s…

  JetBrains YouTrack
  Sep 7, 2026
• Medium 6.5
  CVE-2026-86489

  In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders …

  JetBrains YouTrack
  Sep 7, 2026
• Medium 6.5
  CVE-2026-86490

  In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app im…

  JetBrains YouTrack
  Sep 7, 2026
• Medium 6.5
  CVE-2026-86493

  In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify white…

  JetBrains YouTrack
  Sep 7, 2026
• Medium 6.5
  CVE-2026-86495

  In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inacces…

  JetBrains YouTrack
  Sep 7, 2026
• Medium 5.5
  CVE-2026-86500

  In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant t…

  JetBrains YouTrack
  Sep 7, 2026
• Medium 5.4
  CVE-2026-86483

  In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible

  JetBrains YouTrack
  Sep 7, 2026
• Medium 4.6
  CVE-2026-86484

  In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS

  JetBrains YouTrack
  Sep 7, 2026
• Medium 4.3
  CVE-2026-86481

  In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons

  JetBrains YouTrack
  Sep 7, 2026
• Medium 4.3
  CVE-2026-86496

  In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter emai…

  JetBrains YouTrack
  Sep 7, 2026
• Medium 4.3
  CVE-2026-86499

  In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of vi…

  JetBrains YouTrack
  Sep 7, 2026
• Low 3.7
  CVE-2026-86486

  In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank

  JetBrains YouTrack
  Sep 7, 2026
• Low 3.5
  CVE-2026-86485

  In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks

  JetBrains YouTrack
  Sep 7, 2026
• Low 3.5
  CVE-2026-86491

  In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads

  JetBrains YouTrack
  Sep 7, 2026
• Low 3.1
  CVE-2026-86487

  In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canv…

  JetBrains YouTrack
  Sep 7, 2026

Revision history

1. 2026-09-07 #1

   Initiale Fassung

References

• JetBrains Fixed security issues vom 2026-09-07
  https://www.jetbrains.com/privacy-security/issues-fixed/
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86478
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86479
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86481
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86482
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86483
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86484
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86485
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86486
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86487
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86488
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86489
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86490
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86491
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86492
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86493
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86494
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86495
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86496
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86497
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86498
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86499
• NIST Vunerability Database vom 2026-09-07
  https://nvd.nist.gov/vuln/detail/cve-2026-86500