Read the docs
TI-2026-52730 Aliases CVE-2026-75044GHSA-2r3v-q8q5-q22x

Missing authorization in JetBrains YouTrack

Priority LOW 36CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00424 36th percentileScored 2026-11-07
Fix Fixed YouTrack (JetBrains): 2025.3.156085, 2026.1.13914, 2026.2.18095

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JetBrainsYouTrackbefore 2025.3.156085, 2026.1.13914, 2026.2.180952025.3.156085, 2026.1.13914, 2026.2.18095Patch availableCNA
  • YouTrack VendorJetBrains Affected before 2025.3.156085, 2026.1.13914, 2026.2.18095 Fixed in 2025.3.156085, 2026.1.13914, 2026.2.18095 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*before 2025.3.156085; 2026.1 to before 2026.1.13914; 2026.2 to before 2026.2.18095VulnerableJetBrains
  • cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* Versions before 2025.3.156085; 2026.1 to before 2026.1.13914; 2026.2 to before 2026.2.18095 Vulnerable ·JetBrains

Remediation

  • Fix · CNA YouTrack (JetBrains) Fixed in 2025.3.156085, 2026.1.13914, 2026.2.18095

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-75044
  2. 2026-10-03 Alias added: GHSA-2r3v-q8q5-q22x

References

Advisory 1

  • TI-2026-44538 Missing authentication in JetBrains YouTrack CVSS 3.1CRITICAL 10.0
  • TI-2022-08314 JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. CVSS 3.1CRITICAL 9.8
  • TI-2026-52731 Authentication bypass in JetBrains YouTrack CVSS 3.1CRITICAL 9.1
  • TI-2021-07854 In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was… CVSS 3.1CRITICAL 9.8
  • TI-2021-19197 JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. CVSS 3.1CRITICAL 9.8
  • TI-2019-09636 Certain actions could cause privilege escalation for issue attachments in JetBrains… CVSS 3.0CRITICAL 9.8
See all 156 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences