Jetbrains Youtrack
147 CVEs affecting Jetbrains Youtrack. Latest disclosed: 2026-09-07. Critical: 11, High: 34.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-62422 | Critical | 10.0 | 2026-07-14 | In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database… |
CVE-2026-86478 | Critical | 9.8 | 2026-09-07 | In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asse… |
CVE-2022-24442 | Critical | 9.8 | 2022-02-25 | JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. |
CVE-2021-43185 | Critical | 9.8 | 2021-11-09 | JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. |
CVE-2021-25770 | Critical | 9.8 | 2021-02-03 | In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution. |
CVE-2019-12852 | Critical | 9.8 | 2019-07-03 | An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168. |
CVE-2019-12867 | Critical | 9.8 | 2019-07-03 | Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168. |
CVE-2019-12866 | Critical | 9.8 | 2019-07-03 | An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4… |
CVE-2019-12850 | Critical | 9.8 | 2019-07-03 | A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168. |
CVE-2026-75045 | Critical | 9.1 | 2026-08-17 | In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature |
CVE-2021-37549 | Critical | 9.1 | 2021-08-06 | In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. |
CVE-2026-86482 | High | 8.8 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed privilege escalation |
CVE-2026-28193 | High | 8.8 | 2026-02-25 | In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint |
CVE-2021-25765 | High | 8.8 | 2021-02-03 | In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible. |
CVE-2020-15817 | High | 8.8 | 2020-08-08 | In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues. |
CVE-2019-15040 | High | 8.8 | 2019-10-02 | JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page. |
CVE-2019-12851 | High | 8.8 | 2019-07-03 | A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852. |
CVE-2026-49368 | High | 8.7 | 2026-05-29 | In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible |
CVE-2025-57731 | High | 8.7 | 2025-08-20 | In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content |
CVE-2026-86492 | High | 8.5 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens |