Skip to content
OpenAdvisories
High · 8.1 CVE-2026-75044 EUVD-2026-60243GHSA-2r3v-q8q5-q22x

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitr…

Published Aug 17, 2026 · Updated Aug 17, 2026 · Assigned by JetBrains

Vendor: JetBrains Product: YouTrack

Description

In JetBrains YouTrack before 2025.3.156085,
2026.1.13914,
2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint

Affected products

VendorProductAffectedFixed
JetBrains YouTrack < 2025.3.156085, 2026.1.13914, 2026.2.18095 2025.3.156085, 2026.1.13914, 2026.2.18095

References