Threats affecting pkg:maven/com.jetbrains/youtrack

In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset

CVE-2026-86498 is a high-severity vulnerability in JetBrains YouTrack that affects versions before 2025.3.160480 and 2026.1.14047. It allows PUT requests on link sub-resources to modify linked entities without requiring update permissions, violating proper access control.

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address

In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas

CVE-2026-49370 is a low-severity information disclosure vulnerability in JetBrains YouTrack versions before 2026.1.13162. It involves the exposure of information through fetchApp requests. The vulnerability has a CVSS score of 3.4, indicating limited impact. There is no confirmed patch or official remediation guidance available at this time. No known exploits are reported in the wild. The vulnerability requires high privileges and user interaction to be exploited.

CVE-2026-49369 is a medium severity vulnerability in JetBrains YouTrack versions before 2026.1.13162 that allows information disclosure on the Users and Groups pages. The issue is classified under CWE-863, which relates to improper authorization. The vulnerability does not require user interaction and can be exploited remotely with low complexity, but requires some level of privileges. There is no official patch or remediation level confirmed yet. No known exploits are reported in the wild. The impact is limited to confidentiality loss without affecting integrity or availability.

CVE-2026-49368 is a high-severity stored cross-site scripting (XSS) vulnerability in JetBrains YouTrack versions before 2026.1.13162. The vulnerability allows an attacker with limited privileges to inject malicious scripts into project notification templates, which can be executed in the context of other users. This can lead to complete compromise of confidentiality and integrity of affected users' data. No official patch or remediation guidance is currently confirmed from the vendor. There are no known exploits in the wild at this time.