Threat database

CVE-2026-86499 is a vulnerability in JetBrains YouTrack before version 2026.1.14047 where predefined search fields exposed all group names to any user regardless of their visibility permissions. This issue relates to improper access control (CWE-862). The vulnerability has a medium severity with a CVSS score of 4.3 and does not impact integrity or availability. No known exploits are reported in the wild. A fix is available in version 2026.1.14047.

CVE-2026-86498 is a high-severity vulnerability in JetBrains YouTrack that affects versions before 2025.3.160480 and 2026.1.14047. It allows PUT requests on link sub-resources to modify linked entities without requiring update permissions, violating proper access control.

CVE-2026-86497 is a vulnerability in JetBrains YouTrack before version 2026.2.18769. It allows a project administrator to exfiltrate stored mailbox credentials by changing a mailbox host without re-authentication. The vulnerability has a medium severity with a CVSS score of 6.8.

CVE-2026-86496 is a medium severity vulnerability in JetBrains YouTrack before version 2026.2.18769. It involves missing access control on Helpdesk authorized reporters, which results in exposure of reporter email addresses. The vulnerability does not allow modification or denial of service but does impact confidentiality of reporter information.

CVE-2026-86495 is a vulnerability in JetBrains YouTrack before version 2026.2.18687 where missing permission checks allowed users with limited privileges to create knowledge base articles in projects they should not have access to. This issue is classified under CWE-862 (Missing Authorization). The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No known exploits are reported in the wild, and the product is not a cloud service. A fix is implied by the versioning but no explicit patch link is provided.

CVE-2026-86494 is a vulnerability in JetBrains YouTrack versions before 2026.2.18634 that allows unauthorized changes to links on inaccessible issues when cloning a whiteboard. This issue is classified under CWE-862 (Missing Authorization). The vulnerability has a high severity with a CVSS score of 7.7, indicating it requires low privileges to exploit and can cause a significant integrity impact without affecting confidentiality or availability.

CVE-2026-86493 is a vulnerability in JetBrains YouTrack before version 2026.2.18634 where improper permission checks allowed users with read-only access to create and modify whiteboard cards. This issue is classified under CWE-863 (Incorrect Authorization). The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level. No known exploits in the wild have been reported. The affected versions are all releases prior to 2026.2.18634.

CVE-2026-86492 is a high-severity vulnerability in JetBrains YouTrack before version 2026.2.18634. It involves a shared token cache that allowed cross-tenant theft of GitHub App installation tokens. This flaw could lead to unauthorized access to sensitive tokens across different tenants. The vulnerability has a CVSS score of 8.5, indicating a significant impact on confidentiality with limited integrity impact and no availability impact. No known exploits are reported in the wild. The affected versions are all releases prior to 2026.2.18634.

CVE-2026-86491 is a stored cross-site scripting (XSS) vulnerability in JetBrains YouTrack versions before 2026.2.18634. The vulnerability arises from the ability to upload project and organization icons that can contain malicious scripts. This flaw allows an attacker with high privileges and user interaction to inject scripts that may impact confidentiality and integrity but does not affect availability. The vulnerability has a low CVSS score of 3.5, indicating limited impact. No known exploits are reported in the wild. JetBrains has not explicitly provided a patch link in the data, but the vulnerability is fixed in version 2026.2.18634. Users should upgrade to this version or later to remediate the issue.

CVE-2026-86490 is a medium severity vulnerability in JetBrains YouTrack before version 2026.2.18634. It involves improper permission checks that allow an attacker with limited privileges to overwrite bundled applications via the app import endpoint. This could lead to unauthorized modification of application components without user interaction.