DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
JetBrains You Track: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-09-30
Ein Angreifer kann mehrere Schwachstellen in JetBrains You Track ausnutzen, um Sicherheitsvorkehrungen zu umgehen um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen und um beliebigen Programmcode auszuführen.
01
beschreibt (32)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-103497US | — | — | ||
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration | ||||
| CVE-2026-103496US | — | — | ||
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications | ||||
| CVE-2026-103495US | —OT erhöht | — | ||
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs | ||||
| CVE-2026-103494US | — | — | ||
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes | ||||
| CVE-2026-103493US | — | — | ||
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible | ||||
| CVE-2026-103492US | — | — | ||
In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments | ||||
| CVE-2026-103491US | — | — | ||
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues | ||||
| CVE-2026-103490US | —OT erhöht | — | ||
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links | ||||
| CVE-2026-103489US | medium5.4 | — | ||
In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible | ||||
| CVE-2026-103488US | —OT erhöht | — | ||
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues | ||||
| CVE-2026-100280US | medium4.3OT erhöht | — | ||
In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible | ||||
| CVE-2026-100279US | — | — | ||
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials | ||||
| CVE-2026-100278US | —OT erhöht | — | ||
In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments | ||||
| CVE-2026-100277US | critical9.8OT erhöht | — | ||
In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature | ||||
| CVE-2026-100276US | high7.5OT erhöht | — | ||
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action | ||||
| CVE-2026-100275US | medium4.8 | — | ||
In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible | ||||
| CVE-2026-100274US | — | — | ||
In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template | ||||
| CVE-2026-100273US | critical9.8OT erhöht | — | ||
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution | ||||
| CVE-2026-100272US | — | — | ||
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues | ||||
| CVE-2026-100271US | —OT erhöht | — | ||
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects | ||||
20 von 32 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- National Vulnerability Database CVE-2026-100257 vom 2026-09-30external
- National Vulnerability Database CVE-2026-100258 vom 2026-09-30external
- National Vulnerability Database CVE-2026-100259 vom 2026-09-30external
- National Vulnerability Database CVE-2026-100260 vom 2026-09-30external
- National Vulnerability Database CVE-2026-100261 vom 2026-09-30external
- National Vulnerability Database CVE-2026-100262 vom 2026-09-30external
- National Vulnerability Database CVE-2026-100263 vom 2026-09-30external
- National Vulnerability Database CVE-2026-100267 vom 2026-09-30external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan