Jetbrains Youtrack
117 CVEs affecting Jetbrains Youtrack. Latest disclosed: 2026-07-14. Critical: 9, High: 25.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-62422 | Critical | 10.0 | 2026-07-14 | In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database… |
CVE-2022-24442 | Critical | 9.8 | 2022-02-25 | JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. |
CVE-2021-43185 | Critical | 9.8 | 2021-11-09 | JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. |
CVE-2021-25770 | Critical | 9.8 | 2021-02-03 | In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution. |
CVE-2019-12852 | Critical | 9.8 | 2019-07-03 | An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168. |
CVE-2019-12867 | Critical | 9.8 | 2019-07-03 | Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168. |
CVE-2019-12866 | Critical | 9.8 | 2019-07-03 | An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4… |
CVE-2019-12850 | Critical | 9.8 | 2019-07-03 | A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168. |
CVE-2021-37549 | Critical | 9.1 | 2021-08-06 | In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. |
CVE-2026-28193 | High | 8.8 | 2026-02-25 | In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint |
CVE-2021-25765 | High | 8.8 | 2021-02-03 | In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible. |
CVE-2020-15817 | High | 8.8 | 2020-08-08 | In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues. |
CVE-2019-15040 | High | 8.8 | 2019-10-02 | JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page. |
CVE-2019-12851 | High | 8.8 | 2019-07-03 | A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852. |
CVE-2026-49368 | High | 8.7 | 2026-05-29 | In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible |
CVE-2025-57731 | High | 8.7 | 2025-08-20 | In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content |
CVE-2025-64685 | High | 8.1 | 2025-11-10 | In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure |
CVE-2024-49579 | High | 8.1 | 2024-10-17 | In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests |
CVE-2024-54154 | High | 8.0 | 2024-12-04 | In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox |
CVE-2025-48391 | High | 7.7 | 2025-05-20 | In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API |