DeutschShown in its original language — a full translation is planned for a future version.
JetBrains You Track: Mehrere Schwachstellen
view advisory published 2026-09-30
Ein Angreifer kann mehrere Schwachstellen in JetBrains You Track ausnutzen, um Sicherheitsvorkehrungen zu umgehen um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen und um beliebigen Programmcode auszuführen.
01
describes (32)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-103497US | — | — | ||
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration | ||||
| CVE-2026-103496US | — | — | ||
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications | ||||
| CVE-2026-103495US | —OT elevated | — | ||
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs | ||||
| CVE-2026-103494US | — | — | ||
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes | ||||
| CVE-2026-103493US | — | — | ||
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible | ||||
| CVE-2026-103492US | — | — | ||
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments | ||||
| CVE-2026-103491US | — | — | ||
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues | ||||
| CVE-2026-103490US | —OT elevated | — | ||
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links | ||||
| CVE-2026-103489US | medium5.4 | — | ||
In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible | ||||
| CVE-2026-103488US | —OT elevated | — | ||
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues | ||||
| CVE-2026-100280US | medium4.3OT elevated | — | ||
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible | ||||
| CVE-2026-100279US | — | — | ||
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials | ||||
| CVE-2026-100278US | —OT elevated | — | ||
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments | ||||
| CVE-2026-100277US | critical9.8OT elevated | — | ||
In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature | ||||
| CVE-2026-100276US | high7.5OT elevated | — | ||
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action | ||||
| CVE-2026-100275US | medium4.8 | — | ||
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible | ||||
| CVE-2026-100274US | — | — | ||
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template | ||||
| CVE-2026-100273US | critical9.8OT elevated | — | ||
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution | ||||
| CVE-2026-100272US | — | — | ||
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues | ||||
| CVE-2026-100271US | —OT elevated | — | ||
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects | ||||
showing 20 of 32
02
references
External citations — patches, advisories, analysis.
- National Vulnerability Database CVE-2026-100257 vom 2026-09-30external
- National Vulnerability Database CVE-2026-100258 vom 2026-09-30external
- National Vulnerability Database CVE-2026-100259 vom 2026-09-30external
- National Vulnerability Database CVE-2026-100260 vom 2026-09-30external
- National Vulnerability Database CVE-2026-100261 vom 2026-09-30external
- National Vulnerability Database CVE-2026-100262 vom 2026-09-30external
- National Vulnerability Database CVE-2026-100263 vom 2026-09-30external
- National Vulnerability Database CVE-2026-100267 vom 2026-09-30external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan