Security Vulnerabilities
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible
CVSS Score
6.9
EPSS Score
0.002
Published
2026-09-30
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action
CVSS Score
5.9
EPSS Score
0.002
Published
2026-09-30
In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
CVSS Score
8.9
EPSS Score
0.003
Published
2026-09-30
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
CVSS Score
4.9
EPSS Score
0.002
Published
2026-09-30
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
CVSS Score
6.5
EPSS Score
0.002
Published
2026-09-30
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
CVSS Score
3.1
EPSS Score
0.002
Published
2026-09-30
In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates
CVSS Score
7.7
EPSS Score
0.002
Published
2026-09-30
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
CVSS Score
4.3
EPSS Score
0.002
Published
2026-09-30
In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations
CVSS Score
3.3
EPSS Score
0.002
Published
2026-09-30
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects
CVSS Score
2.7
EPSS Score
0.002
Published
2026-09-30