YouTrack vulnerabilities and CVEs
Known vulnerabilities affecting YouTrack, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.
15 vulnerabilities tracked.
- 8.4 In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send…
- 7.7 In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible
- 7.5 In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions
- 7.1 In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension
- 7.1 In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin…
- 6.4 In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab
- 5.4 In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles
- 5.4 In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings
- 5.4 In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions
- 4.7 In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations
- 3.8 In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project
- 3.8 In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints
- 3.5 In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the…
- 3.1 In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility
- 3.1 In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that YouTrack is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other products tracked here
Linux Red Hat Enterprise Linux 9 Chrome Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 macOS Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Zephyr Red Hat Enterprise Linux 9.6 Extended Update Support Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat Enterprise Linux 10.0 Extended Update Support Android Red Hat Enterprise Linux 7 Extended Lifecycle Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Windows Server 2022 iOS and iPadOS Windows 11 version 26H1 Windows 11 Version 24H2 Windows Server 2025 Windows Server 2025 (Server Core installation) Windows 11 Version 25H2