Skip to content
OpenAdvisories
High WID-SEC-2026-4378 15 CVEs

JetBrains You Track: Mehrere Schwachstellen

Published Nov 5, 2026 · Updated Nov 8, 2026 · Revision 2 · de

Vendor: JetBrains Product: You Track Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in JetBrains You Track ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um beliebigen Programmcode auszuführen.

Product

YouTrack ist eine webbasierte Plattform für Projektmanagement, Issue- und Bug-Tracking, Helpdesk sowie die Verwaltung und Nachverfolgung von Arbeitsabläufen und Aufgaben.

Vulnerabilities 15

  • High 8.4
    CVE-2026-123323

    In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host a…

    JetBrains YouTrack
  • High 7.7
    CVE-2026-123324

    In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible

    JetBrains YouTrack
  • High 7.5
    CVE-2026-123327

    In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue…

    JetBrains YouTrack
  • High 7.1
    CVE-2026-123325

    In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible …

    JetBrains YouTrack
  • High 7.1
    CVE-2026-123326

    In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script discl…

    JetBrains YouTrack
  • Medium 6.4
    CVE-2026-123328

    In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab

    JetBrains YouTrack
  • Medium 5.4
    CVE-2026-123329

    In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other pro…

    JetBrains YouTrack
  • Medium 5.4
    CVE-2026-123330

    In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue vis…

    JetBrains YouTrack
  • Medium 5.4
    CVE-2026-123331

    In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles

    JetBrains YouTrack
  • Medium 4.7
    CVE-2026-123332

    In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server conf…

    JetBrains YouTrack
  • Low 3.8
    CVE-2026-123333

    In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between spri…

    JetBrains YouTrack
  • Low 3.8
    CVE-2026-123334

    In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by an…

    JetBrains YouTrack
  • Low 3.5
    CVE-2026-123335

    In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to …

    JetBrains YouTrack
  • Low 3.1
    CVE-2026-123336

    In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion

    JetBrains YouTrack
  • Low 3.1
    CVE-2026-123337

    In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility

    JetBrains YouTrack

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-118101, EUVD-2026-118100, EUVD-2026-118098, EUVD-2026-118099, EUVD-2026-118097

  2. #1

    Initiale Fassung

References