Vulnerabilities

TI-2026-41705 CVE-2026-57926 · GHSA-pwj4-f48q-v2h2

In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack

MEDIUM 42

In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00337 Published 2026-06-26 Fixed in 2026.2.16593 CWE-1321

TI-2026-41704 CVE-2026-57925 · GHSA-qpjq-4h8h-5xxf

LOW 24

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00273 Published 2026-06-26 Fixed in 2026.2.16593 CWE-862

TI-2026-41703 CVE-2026-57924 · GHSA-2843-jvg8-9qxp

LOW 24

In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00273 Published 2026-06-26 Fixed in 2026.2.16593 CWE-276

TI-2026-41702 CVE-2026-57923 · GHSA-843r-rrmh-xf43

LOW 32

In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00266 Published 2026-06-26 Fixed in 2026.2.16593 CWE-862

TI-2026-41701 CVE-2026-57922 · GHSA-r8gf-2mrm-r9vw

LOW 24

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00238 Published 2026-06-26 Fixed in 2026.2.16593 CWE-862

TI-2026-41700 CVE-2026-57921 · GHSA-q339-r244-45h2

LOW 33

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00299 Published 2026-06-26 Fixed in 2026.2.16593 CWE-862