Read the docs
TI-2026-52735 Aliases CVE-2026-75049GHSA-924r-pw97-j2gg

Missing authorization in JetBrains YouTrack

Priority LOW 29CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0034 27th percentileScored 2026-11-07
Fix Fixed YouTrack (JetBrains): 2026.1.13903, 2026.2.17950

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JetBrainsYouTrackbefore 2026.1.13903, 2026.2.179502026.1.13903, 2026.2.17950Patch availableCNA
  • YouTrack VendorJetBrains Affected before 2026.1.13903, 2026.2.17950 Fixed in 2026.1.13903, 2026.2.17950 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:*before 2026.1.13903; 2026.2 to before 2026.2.17950VulnerableJetBrains
  • cpe:2.3:a:jetbrains:youtrack:*:*:*:*:*:*:*:* Versions before 2026.1.13903; 2026.2 to before 2026.2.17950 Vulnerable ·JetBrains

Remediation

  • Fix · CNA YouTrack (JetBrains) Fixed in 2026.1.13903, 2026.2.17950

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-75049
  2. 2026-10-03 Alias added: GHSA-924r-pw97-j2gg

References

Advisory 1

  • TI-2026-44538 Missing authentication in JetBrains YouTrack CVSS 3.1CRITICAL 10.0
  • TI-2022-08314 JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. CVSS 3.1CRITICAL 9.8
  • TI-2026-52731 Authentication bypass in JetBrains YouTrack CVSS 3.1CRITICAL 9.1
  • TI-2021-07854 In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was… CVSS 3.1CRITICAL 9.8
  • TI-2021-19197 JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. CVSS 3.1CRITICAL 9.8
  • TI-2019-09636 Certain actions could cause privilege escalation for issue attachments in JetBrains… CVSS 3.0CRITICAL 9.8
See all 156 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences