VendorsJetBrainsyoutrackall versions
Vulnerabilities

JetBrains YouTrack

Ranked by severity, then by exploit likelihood, unless you sort otherwise. Click a CVE ID for its full record.

157CVEs
CVE-2021-25768
In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.
Published 2021-02-03 · Modified
5.3EPSS 0.012
CVE-2019-18369
In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was possible.
Published 2019-10-31 · Modified
5.3EPSS 0.011
CVE-2021-37551
In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256.
Published 2021-08-06 · Modified
5.3EPSS 0.007
CVE-2024-28228
In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible
Published 2024-03-07 · Analyzed
5.3EPSS 0.005
CVE-2024-54155
In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication
Published 2024-12-04 · Analyzed
5.3EPSS 0.004
CVE-2025-47850
In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning
Published 2025-05-20 · Analyzed
5.3EPSS 0.004
CVE-2024-47160
In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possible
Published 2024-09-19 · Analyzed
5.3EPSS 0.004
CVE-2024-38504
In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles
Published 2024-06-18 · Modified
5.3EPSS 0.004
CVE-2024-47162
In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page
Published 2024-09-19 · Analyzed
5.3EPSS 0.004
CVE-2024-54158
In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding
Published 2024-12-04 · Analyzed
5.3EPSS 0.003
CVE-2026-57924
In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details
Published 2026-06-26 · Analyzed
5.3EPSS 0.003
CVE-2026-57925
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
Published 2026-06-26 · Analyzed
5.3EPSS 0.003
CVE-2026-100260
In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
Published 2026-09-30 · Analyzed
5.3EPSS 0.003
CVE-2026-57922
In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
Published 2026-06-26 · Analyzed
5.3EPSS 0.002
CVE-2021-25771
In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed.
Published 2021-02-03 · Modified
5.0EPSS 0.016
CVE-2026-100272
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
Published 2026-09-30 · Analyzed
4.9EPSS 0.003
CVE-2026-100278
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments
Published 2026-09-30 · Analyzed
4.9EPSS 0.002
CVE-2019-14956
JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names.
Published 2019-10-02 · Modified
4.3EPSS 0.010
CVE-2021-37554
In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions.
Published 2021-08-06 · Modified
4.3EPSS 0.009
CVE-2026-100258
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
Published 2026-09-30 · Analyzed
4.3EPSS 0.007
CVE-2022-24343
In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.
Published 2022-02-25 · Modified
4.3EPSS 0.006
CVE-2023-50871
In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed
Published 2023-12-15 · Modified
4.3EPSS 0.004
CVE-2024-47159
In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project
Published 2024-09-19 · Analyzed
4.3EPSS 0.003
CVE-2026-75046
In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint
Published 2026-08-17 · Analyzed
4.3EPSS 0.003
CVE-2026-100257
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
Published 2026-09-30 · Analyzed
4.3EPSS 0.002
CVE-2026-49369
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages
Published 2026-05-29 · Analyzed
4.3EPSS 0.002
CVE-2026-100269
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
Published 2026-09-30 · Analyzed
4.3EPSS 0.002
CVE-2026-103495
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
Published 2026-10-01 · Analyzed
4.3EPSS 0.002
CVE-2026-100259
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access
Published 2026-09-30 · Analyzed
4.3EPSS 0.002
CVE-2026-100280
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible
Published 2026-09-30 · Analyzed
4.3EPSS 0.002
CVE-2020-11692
In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators.
Published 2020-04-22 · Modified
4.0EPSS 0.009
CVE-2025-64773
In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit
Published 2025-11-11 · Modified
3.7EPSS 0.002
CVE-2026-59791
In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible
Published 2026-07-10 · Analyzed
3.5EPSS 0.002
CVE-2020-24366
Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups.
Published 2020-11-16 · Modified
3.3EPSS 0.003
CVE-2026-100270
In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations
Published 2026-09-30 · Analyzed
3.3EPSS 0.002
CVE-2026-100264
In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host
Published 2026-09-30 · Analyzed
2.7EPSS 0.002
CVE-2026-100271
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects
Published 2026-09-30 · Analyzed
2.7EPSS 0.002
← Prev4 / 4