JetBrains YouTrack vulnerabilities

In JetBrains YouTrack before 2026.2.19422, SSRF was possible via the GitHub VCS integration.

In JetBrains YouTrack before 2026.2.19422, iDOR in inbox threads allowed reading other users' notifications.

In JetBrains YouTrack before 2026.2.19422, missing authorisation allowed reloading of translation catalogs.

In JetBrains YouTrack before 2026.2.19422, stored XSS via Mermaid and LaTeX content was possible. The vulnerability allows execution of arbitrary script in the user's browser.

In JetBrains YouTrack before 2026.2.19422, DoS attack was possible via crafted PSD attachments.

In JetBrains YouTrack before 2026.2.19422, iDOR in the issue activities API allowed reading restricted issues.

In JetBrains YouTrack before 2025.3.161254 and 2026.1.14042, improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address.

In JetBrains YouTrack before versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, an authentication bypass via direct database access was possible, leading to administrative access.

In JetBrains YouTrack before 2026.2.19575, 2026.3.16075, 2026.3.16397, and 2026.3.16402, mail rules allowed a project admin to execute cross-project issue commands. This violates the isolation of permissions between projects.

In JetBrains YouTrack before 2026.2.19422, privilege escalation was possible via user group membership changes.

In JetBrains YouTrack before 2026.2.19422, privilege escalation was possible via user group links. The vulnerability allows a user to gain higher privileges than intended.

In JetBrains YouTrack before 2026.2.19422, HTML injection in VCS command failure notifications was possible.

In JetBrains YouTrack before 2026.2.19422, missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues. The vulnerability enables bypassing access controls.

In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible.

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials. A user able to edit the integration could gain access to the authentication data.

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments. This violates data integrity and access control.

In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature.

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action. This allows bypassing access control mechanisms.

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible. Malicious code could be stored and executed in the victim's browser.

In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template. This may lead to service unavailability.

In JetBrains YouTrack before version 2026.2.19197, an authorization bypass in the scripts debugger allows arbitrary code execution.

In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues. This violates data confidentiality.

In JetBrains YouTrack before version 2026.2.19197, missing authorization on several endpoints allowed authenticated users to access information from other projects.

In JetBrains YouTrack before version 2026.2.19197, users with low-level Admin Read permission could disclose integration credentials via import configurations.

In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed. This allows unauthorized issue submission.

In JetBrains YouTrack before version 2026.2.19197, project administrators could read comments from other projects via notification templates.

In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters. This may lead to excessive resource consumption.

In JetBrains YouTrack before version 2026.2.18991, stored SMTP server credentials could be disclosed by changing the server host.

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible. Malicious content could be stored and displayed to other users.

In JetBrains YouTrack before version 2026.2.18991, missing authorization allowed users with read-only project access to overwrite project notification templates.

In JetBrains YouTrack before version 2026.2.18991, changing article visibility settings was possible without update permission.

In JetBrains YouTrack before version 2026.2.18991, mailbox integration allowed authentication after a password reset.

In JetBrains YouTrack before version 2026.2.18991, improper access control on Gantt chart allowed edits by users with view-only access.

In JetBrains YouTrack before version 2026.2.18991, missing authorisation allowed read-only users to read project settings.

In JetBrains YouTrack before version 2026.2.18991, SSRF via stored XHTML injection was possible during PDF export.

In JetBrains YouTrack before version 2026.1.14047, a missing escalation check allowed a user with project update permissions to grant themselves the Project Admin role.

In JetBrains YouTrack before version 2026.1.14047, predefined search fields leaked all group names to any user, regardless of visibility permissions.

In JetBrains YouTrack before version 2026.2.18769, changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials.

In JetBrains YouTrack before version 2026.2.18769, missing access control on Helpdesk authorized reporters exposed reporter email addresses.

In JetBrains YouTrack before version 2026.2.18687, missing permission checks allowed creating knowledge base articles in inaccessible projects.

In JetBrains YouTrack before version 2026.2.18634, improper permission checks allowed read-only users to create and modify whiteboard cards.

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads.

In JetBrains YouTrack before version 2026.2.18634, improper permission checks allowed overwriting of bundled apps via the app import endpoint.

In JetBrains YouTrack before version 2026.2.18634, an IDOR in the user profile API disclosed private issues and starred folders across organizations.

In JetBrains YouTrack before version 2026.2.18634, an IDOR via the watchRules and issueListConfig endpoints exposed private saved searches.

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content.

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank.

In JetBrains YouTrack before 2026.2.18634 IP spoofing via HTTP headers allowed forged Bitbucket webhooks.

In JetBrains YouTrack before version 2026.2.18634, AngularJS template injection in assignee names led to stored XSS.

In JetBrains YouTrack before version 2026.2.18634, stored XSS via a custom field on Agile board cards was possible.