A vulnerability in JetBrains YouTrack before version 2026.2.19728 allows bypassing the attachment size limit via AI assistant thread conversion. This could lead to denial of service due to resource exhaustion but does not impact confidentiality or integrity.
A vulnerability in JetBrains YouTrack before version 2026.2.19656 allows users without update permission to change issue visibility. This flaw could lead to unauthorized disclosure of issue visibility settings but does not impact issue content or availability.
A missing authorization vulnerability in JetBrains YouTrack versions before 2026.2.19562 allowed users with Project Admin privileges to manage version control system (VCS) hosting server configurations. This flaw could lead to unauthorized configuration changes impacting confidentiality, integrity, and availability. The vulnerability has a medium severity rating with a CVSS score of 4.7.
CVE-2026-66293 is an XML injection vulnerability in the encoder component of the Saxy library. The encoder fails to properly neutralize the '--' sequence within XML comment content, allowing an attacker to prematurely close comments and inject arbitrary sibling markup. This can lead to stored cross-site scripting (XSS) when rendered as HTML or SVG, or data forgery when processed by other XML consumers. The vulnerability affects Saxy versions from 0.7.0 up to but not including 1.7.0.
A missing authorization vulnerability in JetBrains YouTrack versions prior to 2026.2.19562, 2026.1.14137, and 2025.3.169041 allows users with limited privileges to attach tags to any issue via the tag issues collection. This issue has a low severity impact and does not affect confidentiality or availability.
A missing authorization vulnerability in JetBrains YouTrack's TeamCity integration before version 2026.2.19562 allows users with limited privileges to view actions from other projects. This issue could lead to unauthorized disclosure of project activity information.
A vulnerability in JetBrains YouTrack before version 2026.2.19656 allows an app permission bypass that can lead to privilege escalation via the project tab. This flaw could enable users with certain privileges to gain higher-level access than intended.
A vulnerability in JetBrains YouTrack versions before 2026.2.19562 allows unauthorized disclosure of issue descriptions via a saved query endpoint due to missing authorization checks.
A vulnerability in JetBrains YouTrack versions before 2026.2.19197 allows article editors to change the visibility of restricted child articles. This could lead to unauthorized information disclosure. The issue is classified as CWE-862 (Missing Authorization).
A vulnerability in JetBrains YouTrack versions before 2026.2.19562 allows users with read-only access to change issue visibility settings due to missing authorization checks.
A vulnerability in JetBrains YouTrack before versions 2025.3.170763, 2026.1.14150, and 2026.2.19656 allows inclusion of untrusted remote code via the plugin sandbox page. This flaw could lead to high impact on integrity with limited confidentiality impact and no availability impact. The vulnerability has a CVSS score of 7.1, indicating a high severity level.
JetBrains YouTrack versions before 2025.3.170763, 2026.1.14150, and 2026.2.19656 contain an improper URL validation vulnerability in the app widget host. This flaw allows applications to send REST requests without requiring user confirmation, potentially leading to unauthorized actions. The vulnerability has a high severity score of 8.4 CVSS v3.1.
A vulnerability in JetBrains YouTrack before version 2026.2.19197 allows incorrect authorization in the scripts debugger. This flaw permits unauthorized disclosure and suspension of workflow scripts. The issue is classified as CWE-863 (Incorrect Authorization) and has a CVSS v3.1 score of 7.1, indicating high severity.
JetBrains WebStorm versions before 2026.3 and 2026.2.3 are vulnerable to code execution via Grunt and Gulp task loading in untrusted projects. This vulnerability allows an attacker to execute arbitrary code when loading these tasks, potentially compromising confidentiality, integrity, and availability of the affected system.
A code execution vulnerability exists in JetBrains WebStorm versions before 2026.3 and 2026.2.4. This flaw allows code execution in untrusted projects via the Angular CLI schematics loader. The vulnerability has a CVSS score of 6.3, indicating a medium severity level.
A vulnerability in JetBrains YouTrack versions before 2026.2.19562 allowed information disclosure through shared mailbox message history. This flaw could expose sensitive information to unauthorized users with limited privileges. The issue is classified as a high severity security risk with a CVSS score of 7.7.
JetBrains Toolbox App versions before 3.9 have a vulnerability where the login dialog provides insufficient warning, potentially allowing users to connect to a malicious server. This issue does not impact confidentiality or availability but may allow limited integrity impact. The vulnerability has a low severity score of 3.1 and requires user interaction with high attack complexity.
JetBrains Ktor versions before 3.6.1 have a vulnerability due to missing validation of the Domain attribute in client cookie storage, which allows cookie injection. This flaw could enable an attacker to inject cookies improperly. The vulnerability has a low severity score and does not impact confidentiality or availability, only integrity to a limited extent.
A vulnerability in JetBrains Ktor versions prior to 3.6.1 allows session forgery through tampered encrypted session cookies. This flaw enables an attacker with low privileges to manipulate session cookies, potentially leading to unauthorized access or impersonation of legitimate users. The vulnerability has a high severity score of 8.1 and impacts confidentiality and integrity but not availability.
JetBrains Ktor versions prior to 3.6.1 contain a vulnerability in the CIO engine that allows HTTP request smuggling. This flaw could enable an attacker to interfere with the processing of HTTP requests, potentially leading to limited confidentiality and integrity impacts. The vulnerability has a medium severity rating with a CVSS score of 4.8. No official patch links are provided, but the issue is fixed starting from version 3.6.1.