Jetbrains: >> Youtrack >> 2.2.1 Security Vulnerabilities
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
CVSS Score
4.9
EPSS Score
0.003
Published
2026-09-30
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
CVSS Score
8.2
EPSS Score
0.003
Published
2026-09-30
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template
CVSS Score
6.5
EPSS Score
0.008
Published
2026-09-30
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates
CVSS Score
7.6
EPSS Score
0.002
Published
2026-09-30
In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible
CVSS Score
4.7
EPSS Score
0.002
Published
2026-09-30
In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host
CVSS Score
2.7
EPSS Score
0.002
Published
2026-09-30
In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
CVSS Score
5.9
EPSS Score
0.003
Published
2026-09-30
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
CVSS Score
4.3
EPSS Score
0.002
Published
2026-09-30
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
CVSS Score
4.3
EPSS Score
0.007
Published
2026-09-30
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access
CVSS Score
4.3
EPSS Score
0.002
Published
2026-09-30