Threat Intelligence Database

In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission

CVE-2026-86498 is a high-severity vulnerability in JetBrains YouTrack that affects versions before 2025.3.160480 and 2026.1.14047. It allows PUT requests on link sub-resources to modify linked entities without requiring update permissions, violating proper access control.

In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons

CVE-2026-86479 is a high-severity vulnerability in JetBrains YouTrack that allows unauthorized access to restricted REST API resources due to missing authorization checks (CWE-862). This affects versions before 2026.2.18788, 2026.1.14055, and 2025.3.161254. The vulnerability enables an attacker with limited privileges to access sensitive data via an IDOR (Insecure Direct Object Reference) flaw. No known exploits are reported in the wild, and no official patch links are provided in the available data.

CVE-2026-86478 is a critical authentication vulnerability in JetBrains YouTrack before versions 2025.3.161254 and 2026.1.14042. It allows unauthenticated attackers to take over accounts by exploiting improper authentication in the YouTrack Helpdesk component via self-asserted email addresses.

In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas

CVE-2026-49370 is a low-severity information disclosure vulnerability in JetBrains YouTrack versions before 2026.1.13162. It involves the exposure of information through fetchApp requests. The vulnerability has a CVSS score of 3.4, indicating limited impact. There is no confirmed patch or official remediation guidance available at this time. No known exploits are reported in the wild. The vulnerability requires high privileges and user interaction to be exploited.

CVE-2026-49369 is a medium severity vulnerability in JetBrains YouTrack versions before 2026.1.13162 that allows information disclosure on the Users and Groups pages. The issue is classified under CWE-863, which relates to improper authorization. The vulnerability does not require user interaction and can be exploited remotely with low complexity, but requires some level of privileges. There is no official patch or remediation level confirmed yet. No known exploits are reported in the wild. The impact is limited to confidentiality loss without affecting integrity or availability.