# JetBrains YouTrack.

Every CVE that names JetBrains YouTrack among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-111092.md)
  `CVE-2026-111092` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Server-side request forgery in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103497.md)
  `CVE-2026-103497` · CVE record: JetBrains YouTrack · CVSS 5.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Insecure direct object reference in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103496.md)
  `CVE-2026-103496` · CVE record: JetBrains YouTrack · CVSS 5.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103495.md)
  `CVE-2026-103495` · CVE record: JetBrains YouTrack · CVSS 4.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [JetBrains YouTrack: In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user…](https://agentprime.io/advisories/CVE-2026-103494.md)
  `CVE-2026-103494` · CVE record: JetBrains YouTrack · CVSS 6.6 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation
- [Cross-site scripting in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103493.md)
  `CVE-2026-103493` · CVE record: JetBrains YouTrack · CVSS 8.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Infinite loop in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103492.md)
  `CVE-2026-103492` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Denial of service
- [Insecure direct object reference in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103491.md)
  `CVE-2026-103491` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103490.md)
  `CVE-2026-103490` · CVE record: JetBrains YouTrack · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Cross-site scripting in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103489.md)
  `CVE-2026-103489` · CVE record: JetBrains YouTrack · CVSS 2.0 Low · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103488.md)
  `CVE-2026-103488` · CVE record: JetBrains YouTrack · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100280.md)
  `CVE-2026-100280` · CVE record: JetBrains YouTrack · CVSS 3.1 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Server-side request forgery in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100279.md)
  `CVE-2026-100279` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100278.md)
  `CVE-2026-100278` · CVE record: JetBrains YouTrack · CVSS 4.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100277.md)
  `CVE-2026-100277` · CVE record: JetBrains YouTrack · CVSS 8.9 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100276.md)
  `CVE-2026-100276` · CVE record: JetBrains YouTrack · CVSS 5.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Cross-site scripting in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100275.md)
  `CVE-2026-100275` · CVE record: JetBrains YouTrack · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Resource allocation without limits in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100274.md)
  `CVE-2026-100274` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Denial of service
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100273.md)
  `CVE-2026-100273` · CVE record: JetBrains YouTrack · CVSS 8.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Insecure direct object reference in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100272.md)
  `CVE-2026-100272` · CVE record: JetBrains YouTrack · CVSS 4.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100271.md)
  `CVE-2026-100271` · CVE record: JetBrains YouTrack · CVSS 2.7 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100270.md)
  `CVE-2026-100270` · CVE record: JetBrains YouTrack · CVSS 3.3 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100269.md)
  `CVE-2026-100269` · CVE record: JetBrains YouTrack · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Insecure direct object reference in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100268.md)
  `CVE-2026-100268` · CVE record: JetBrains YouTrack · CVSS 7.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Regular expression denial of service in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100267.md)
  `CVE-2026-100267` · CVE record: JetBrains YouTrack · CVSS 5.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Denial of service
- [Insufficiently protected credentials in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100264.md)
  `CVE-2026-100264` · CVE record: JetBrains YouTrack · CVSS 2.7 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Hard-coded credentials
- [Cross-site scripting in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100263.md)
  `CVE-2026-100263` · CVE record: JetBrains YouTrack · CVSS 4.7 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100262.md)
  `CVE-2026-100262` · CVE record: JetBrains YouTrack · CVSS 7.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Authentication bypass in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100261.md)
  `CVE-2026-100261` · CVE record: JetBrains YouTrack · CVSS 5.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Authentication bypass
- [JetBrains YouTrack: In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication…](https://agentprime.io/advisories/CVE-2026-100260.md)
  `CVE-2026-100260` · CVE record: JetBrains YouTrack · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-1188
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100259.md)
  `CVE-2026-100259` · CVE record: JetBrains YouTrack · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Information disclosure in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100258.md)
  `CVE-2026-100258` · CVE record: JetBrains YouTrack · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure
- [Server-side request forgery in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100257.md)
  `CVE-2026-100257` · CVE record: JetBrains YouTrack · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [JetBrains YouTrack: In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with…](https://agentprime.io/advisories/CVE-2026-86500.md)
  `CVE-2026-86500` · CVE record: JetBrains YouTrack · CVSS 5.5 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Privilege escalation
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86499.md)
  `CVE-2026-86499` · CVE record: JetBrains YouTrack · CVSS 4.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86498.md)
  `CVE-2026-86498` · CVE record: JetBrains YouTrack · CVSS 7.7 High · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control
- [Information disclosure in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86497.md)
  `CVE-2026-86497` · CVE record: JetBrains YouTrack · CVSS 6.8 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Information disclosure
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86496.md)
  `CVE-2026-86496` · CVE record: JetBrains YouTrack · CVSS 4.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86495.md)
  `CVE-2026-86495` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86494.md)
  `CVE-2026-86494` · CVE record: JetBrains YouTrack · CVSS 7.7 High · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86493.md)
  `CVE-2026-86493` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control
- [JetBrains YouTrack: In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft…](https://agentprime.io/advisories/CVE-2026-86492.md)
  `CVE-2026-86492` · CVE record: JetBrains YouTrack · CVSS 8.5 High · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-488
- [Cross-site scripting in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86491.md)
  `CVE-2026-86491` · CVE record: JetBrains YouTrack · CVSS 3.5 Low · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86490.md)
  `CVE-2026-86490` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control
- [Insecure direct object reference in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86489.md)
  `CVE-2026-86489` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control
- [Insecure direct object reference in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86488.md)
  `CVE-2026-86488` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86487.md)
  `CVE-2026-86487` · CVE record: JetBrains YouTrack · CVSS 3.1 Low · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control
- [Missing authentication in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86486.md)
  `CVE-2026-86486` · CVE record: JetBrains YouTrack · CVSS 3.7 Low · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [JetBrains YouTrack: In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged…](https://agentprime.io/advisories/CVE-2026-86485.md)
  `CVE-2026-86485` · CVE record: JetBrains YouTrack · CVSS 3.5 Low · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-291
- [Cross-site scripting in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86484.md)
  `CVE-2026-86484` · CVE record: JetBrains YouTrack · CVSS 4.6 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86483.md)
  `CVE-2026-86483` · CVE record: JetBrains YouTrack · CVSS 5.4 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Cross-site scripting (XSS)
- [JetBrains YouTrack: In JetBrains YouTrack before 2026.2.18634…](https://agentprime.io/advisories/CVE-2026-86482.md)
  `CVE-2026-86482` · CVE record: JetBrains YouTrack · CVSS 8.8 High · Not analysed yet · Published 7 Sept 2026 · Tags: Privilege escalation
- [Insecure direct object reference in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86481.md)
  `CVE-2026-86481` · CVE record: JetBrains YouTrack · CVSS 4.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86479.md)
  `CVE-2026-86479` · CVE record: JetBrains YouTrack · CVSS 8.0 High · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control
- [Authentication bypass by spoofing in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86478.md)
  `CVE-2026-86478` · CVE record: JetBrains YouTrack · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-75051.md)
  `CVE-2026-75051` · CVE record: JetBrains YouTrack · CVSS 8.1 High · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control
- [Resource allocation without limits in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-75050.md)
  `CVE-2026-75050` · CVE record: JetBrains YouTrack · CVSS 7.1 High · Not analysed yet · Published 17 Aug 2026 · Tags: Denial of service
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-75049.md)
  `CVE-2026-75049` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control
- [Cross-site scripting in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-75048.md)
  `CVE-2026-75048` · CVE record: JetBrains YouTrack · CVSS 8.2 High · Not analysed yet · Published 17 Aug 2026 · Tags: Cross-site scripting (XSS)
- [JetBrains YouTrack: In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression…](https://agentprime.io/advisories/CVE-2026-75047.md)
  `CVE-2026-75047` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-409

Older: <https://agentprime.io/advisories/technology/jetbrains-youtrack.md?cursor=WyIyMDI2LTA4LTE3VDE1OjU0OjM1LjU1MzAwMFoiLCJDVkUtMjAyNi03NTA0NyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=jetbrains-youtrack>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/jetbrains-youtrack/>. Everything for agents: <https://agentprime.io/llms.txt>.