CVE-2026-103488

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues...

EUVD-2026-90579

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues...

CVE-2026-103495: Missing Authorization

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs...

CVE-2026-103494: Incorrect Privilege Assignment

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...

CVE-2026-103493: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible...

CVE-2026-103492: Loop with Unreachable Exit Condition

In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments...

CVE-2026-103491: Authorization Bypass Through User-Controlled Key

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues...

CVE-2026-103490: Missing Authorization

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...

CVE-2026-103489: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible...

CVE-2026-103496: Authorization Bypass Through User-Controlled Key

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications...

CVE-2026-103488: Incorrect Authorization

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues...

CVE-2026-103497: Server-Side Request Forgery (SSRF)

In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration...

PT-2026-103757

In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration...

PT-2026-103748

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.19422 Description Missing authorization allows authenticated users to add themselves to project teams, which enables them to access restricted issues. Recommendations Update to version 2026.2.19422...

PT-2026-103751

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues...

PT-2026-103755

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs...

PT-2026-103752

In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments...

PT-2026-103750

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.19422 Description Privilege escalation is possible through the use of user group links. Recommendations Update to version 2026.2.19422...

PT-2026-103756

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications...

PT-2026-103749

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.19422 Description An HTML injection issue exists in the VCS command failure notifications. This allows an attacker to inject malicious HTML content into the notifications triggered when a Version...