JetBrains You Track: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 32

• High 8.9
  CVE-2026-100277

  In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature

  JetBrains YouTrack
  Sep 30, 2026
• High 8.2
  CVE-2026-100273

  In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution

  JetBrains YouTrack
  Sep 30, 2026
• High 8.1
  CVE-2026-103493

  In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible

  JetBrains YouTrack
  Oct 1, 2026
• High 7.7
  CVE-2026-100268

  In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notificati…

  JetBrains YouTrack
  Sep 30, 2026
• High 7.6
  CVE-2026-100262

  In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrit…

  JetBrains YouTrack
  Sep 30, 2026
• High 7.2
  CVE-2026-103490

  In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links

  JetBrains YouTrack
  Oct 1, 2026
• High 7.1
  CVE-2026-103488

  In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to projec…

  JetBrains YouTrack
  Oct 1, 2026
• Medium 6.9
  CVE-2026-100275

  In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible

  JetBrains YouTrack
  Sep 30, 2026
• Medium 6.6
  CVE-2026-103494

  In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes

  JetBrains YouTrack
  Oct 1, 2026
• Medium 6.5
  CVE-2026-100274

  In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template

  JetBrains YouTrack
  Sep 30, 2026
• Medium 6.5
  CVE-2026-100279

  In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials

  JetBrains YouTrack
  Sep 30, 2026
• Medium 6.5
  CVE-2026-103491

  In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

  JetBrains YouTrack
  Oct 1, 2026
• Medium 6.5
  CVE-2026-103492

  In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments

  JetBrains YouTrack
  Oct 1, 2026
• Medium 5.9
  CVE-2026-100267

  In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters

  JetBrains YouTrack
  Sep 30, 2026
• Medium 5.9
  CVE-2026-100276

  In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run t…

  JetBrains YouTrack
  Sep 30, 2026
• Medium 5.5
  CVE-2026-103497

  In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration

  JetBrains YouTrack
  Oct 1, 2026
• Medium 5.4
  CVE-2026-100261

  In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

  JetBrains YouTrack
  Sep 30, 2026
• Medium 5.4
  CVE-2026-103496

  In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

  JetBrains YouTrack
  Oct 1, 2026
• Medium 5.3
  CVE-2026-100260

  In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset

  JetBrains YouTrack
  Sep 30, 2026
• Medium 4.9
  CVE-2026-100272

  In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Ad…

  JetBrains YouTrack
  Sep 30, 2026
• Medium 4.9
  CVE-2026-100278

  In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments

  JetBrains YouTrack
  Sep 30, 2026
• Medium 4.7
  CVE-2026-100263

  In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

  JetBrains YouTrack
  Sep 30, 2026
• Medium 4.3
  CVE-2026-100257

  In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export

  JetBrains YouTrack
  Sep 30, 2026
• Medium 4.3
  CVE-2026-100258

  In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings

  JetBrains YouTrack
  Sep 30, 2026
• Medium 4.3
  CVE-2026-100259

  In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only …

  JetBrains YouTrack
  Sep 30, 2026
• Medium 4.3
  CVE-2026-100269

  In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed

  JetBrains YouTrack
  Sep 30, 2026
• Medium 4.3
  CVE-2026-103495

  In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

  JetBrains YouTrack
  Oct 1, 2026
• Low 3.3
  CVE-2026-100270

  In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials …

  JetBrains YouTrack
  Sep 30, 2026
• Low 3.1
  CVE-2026-100280

  In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible

  JetBrains YouTrack
  Sep 30, 2026
• Low 2.7
  CVE-2026-100264

  In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host

  JetBrains YouTrack
  Sep 30, 2026
• Low 2.7
  CVE-2026-100271

  In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to acc…

  JetBrains YouTrack
  Sep 30, 2026
• Low 2.0
  CVE-2026-103489

  In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible

  JetBrains YouTrack
  Oct 1, 2026

Revision history

1. 2026-10-01 #2

   Referenz(en) aufgenommen: EUVD-2026-90587

2. 2026-09-30 #1

   Initiale Fassung

References

• JetBrains Fixed security issues vom 2026-09-30
  https://www.jetbrains.com/privacy-security/issues-fixed/
• National Vulnerability Database CVE-2026-100257 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100257
• National Vulnerability Database CVE-2026-100258 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100258
• National Vulnerability Database CVE-2026-100259 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100259
• National Vulnerability Database CVE-2026-100260 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100260
• National Vulnerability Database CVE-2026-100261 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100261
• National Vulnerability Database CVE-2026-100262 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100262
• National Vulnerability Database CVE-2026-100263 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100263
• National Vulnerability Database CVE-2026-100267 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100267
• National Vulnerability Database CVE-2026-100268 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100268
• National Vulnerability Database CVE-2026-100269 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100269
• National Vulnerability Database CVE-2026-100270 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100270
• National Vulnerability Database CVE-2026-100271 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100271
• National Vulnerability Database CVE-2026-100272 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100272
• National Vulnerability Database CVE-2026-100273 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100273
• National Vulnerability Database CVE-2026-100274 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100274
• National Vulnerability Database CVE-2026-100275 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100275
• National Vulnerability Database CVE-2026-100276 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100276
• National Vulnerability Database CVE-2026-100277 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100277
• National Vulnerability Database CVE-2026-100278 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100278
• National Vulnerability Database CVE-2026-100279 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100279
• National Vulnerability Database CVE-2026-100280 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-100280
• National Vulnerability Database CVE-2026-103488 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-103488
• National Vulnerability Database CVE-2026-103489 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-103489
• National Vulnerability Database CVE-2026-103490 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-103490
• National Vulnerability Database CVE-2026-103491 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-103491
• National Vulnerability Database CVE-2026-103492 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-103492
• National Vulnerability Database CVE-2026-103493 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-103493
• National Vulnerability Database CVE-2026-103494 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-103494
• National Vulnerability Database CVE-2026-103495 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-103495
• National Vulnerability Database CVE-2026-103496 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-103496
• National Vulnerability Database CVE-2026-103497 vom 2026-09-30
  https://nvd.nist.gov/vuln/detail/CVE-2026-103497