Threats affecting pkg:maven/com.jetbrains/youtrack

CVE-2026-111092 is a vulnerability in JetBrains YouTrack that affects versions before 2026.2.19575 and specific 2026.3.x builds (16075, 16397, 16402). It allows a project administrator to execute cross-project issue commands via mail rules, which is a privilege escalation issue related to improper authorization (CWE-862). The vulnerability has a medium severity with a CVSS score of 6.5.

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

CVE-2026-103494 is a privilege escalation vulnerability in JetBrains YouTrack versions before 2026.2.19422. The issue arises from improper control over user group membership changes, allowing users with certain privileges to escalate their access rights. The vulnerability has a CVSS score of 6.6, indicating a medium severity level.

CVE-2026-103490 is a privilege escalation vulnerability in JetBrains YouTrack versions prior to 2026.2.19422. The issue arises from improper access control related to user group links, classified under CWE-862. This vulnerability allows users with certain privileges to escalate their access rights, potentially leading to full control over the affected system. The vulnerability has a high severity rating with a CVSS score of 7.2. No known exploits are reported in the wild, and no official patch links are provided in the input data.

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues

In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments

CVE-2026-100277 is a high severity vulnerability in JetBrains YouTrack versions before 2026.2.19197. It allows an attacker to perform an account takeover by replaying a notification signature. The vulnerability is classified as CWE-863, indicating an authorization bypass issue. The flaw affects YouTrack versions from initial releases up to but not including 2026.2.19197.

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action

In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template

CVE-2026-100273 is a high-severity vulnerability in JetBrains YouTrack before version 2026.2.19197. It involves an authorization bypass in the scripts debugger component that allows arbitrary code execution. The vulnerability has a CVSS score of 8.2, indicating significant impact on confidentiality and integrity. No official patch link is provided in the data, and the product is not a cloud service. There are no known exploits in the wild at this time.

In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues

In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects

In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations

In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed

In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates

In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates