Youtrack

CVEs (153)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-62422	Jetbrains Youtrack	Cri	0.65	10.0	0.01	Jul 14, 2026	In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
CVE-2026-86478	Jetbrains Youtrack	Cri	0.64	9.8	0.01	Sep 7, 2026	In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address
CVE-2022-24442	Jetbrains Youtrack	Cri	0.64	9.8	0.04	Feb 25, 2022	JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
CVE-2021-43185	Jetbrains Youtrack	Cri	0.64	9.8	0.02	Nov 9, 2021	JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection.
CVE-2021-25770	Jetbrains Youtrack	Cri	0.64	9.8	0.03	Feb 3, 2021	In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution.
CVE-2019-12852	Jetbrains Youtrack	Cri	0.64	9.8	0.02	Jul 3, 2019	An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168.
CVE-2019-12867	Jetbrains Youtrack	Cri	0.64	9.8	0.02	Jul 3, 2019	Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168.
CVE-2019-12866	Jetbrains Youtrack	Cri	0.64	9.8	0.02	Jul 3, 2019	An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168.
CVE-2019-12850	Jetbrains Youtrack	Cri	0.64	9.8	0.02	Jul 3, 2019	A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168.
CVE-2026-75045	Jetbrains Youtrack	Cri	0.59	9.1	0.00	Aug 17, 2026	In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
CVE-2021-37549	Jetbrains Youtrack	Cri	0.59	9.1	0.01	Aug 6, 2021	In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient.
CVE-2026-86482	Jetbrains Youtrack	Hig	0.57	8.8	0.00	Sep 7, 2026	In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation
CVE-2026-49368	Jetbrains Youtrack	Hig	0.57	8.7	0.00	May 29, 2026	In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
CVE-2026-28193	Jetbrains Youtrack	Hig	0.57	8.8	0.00	Feb 25, 2026	In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint
CVE-2025-57731	Jetbrains Youtrack	Hig	0.57	8.7	0.00	Aug 20, 2025	In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content
CVE-2021-25765	Jetbrains Youtrack	Hig	0.57	8.8	0.01	Feb 3, 2021	In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.
CVE-2020-15817	Jetbrains Youtrack	Hig	0.57	8.8	0.02	Aug 8, 2020	In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.
CVE-2019-15040	Jetbrains Youtrack	Hig	0.57	8.8	0.01	Oct 2, 2019	JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page.
CVE-2019-12851	Jetbrains Youtrack	Hig	0.57	8.8	0.01	Jul 3, 2019	A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852.
CVE-2026-86492	Jetbrains Youtrack	Hig	0.55	8.5	0.01	Sep 7, 2026	In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens

CVE-2026-62422CriJul 14, 2026
Jetbrains
Youtrack
risk 0.65cvss 10.0epss 0.01
In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
CVE-2026-86478CriSep 7, 2026
Jetbrains
Youtrack
risk 0.64cvss 9.8epss 0.01
In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address
CVE-2022-24442CriFeb 25, 2022
Jetbrains
Youtrack
risk 0.64cvss 9.8epss 0.04
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
CVE-2021-43185CriNov 9, 2021
Jetbrains
Youtrack
risk 0.64cvss 9.8epss 0.02
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection.
CVE-2021-25770CriFeb 3, 2021
Jetbrains
Youtrack
risk 0.64cvss 9.8epss 0.03
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution.
CVE-2019-12852CriJul 3, 2019
Jetbrains
Youtrack
risk 0.64cvss 9.8epss 0.02
An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168.
CVE-2019-12867CriJul 3, 2019
Jetbrains
Youtrack
risk 0.64cvss 9.8epss 0.02
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168.
CVE-2019-12866CriJul 3, 2019
Jetbrains
Youtrack
risk 0.64cvss 9.8epss 0.02
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168.
CVE-2019-12850CriJul 3, 2019
Jetbrains
Youtrack
risk 0.64cvss 9.8epss 0.02
A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168.
CVE-2026-75045CriAug 17, 2026
Jetbrains
Youtrack
risk 0.59cvss 9.1epss 0.00
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
CVE-2021-37549CriAug 6, 2021
Jetbrains
Youtrack
risk 0.59cvss 9.1epss 0.01
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient.
CVE-2026-86482HigSep 7, 2026
Jetbrains
Youtrack
risk 0.57cvss 8.8epss 0.00
In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation
CVE-2026-49368HigMay 29, 2026
Jetbrains
Youtrack
risk 0.57cvss 8.7epss 0.00
In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
CVE-2026-28193HigFeb 25, 2026
Jetbrains
Youtrack
risk 0.57cvss 8.8epss 0.00
In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint
CVE-2025-57731HigAug 20, 2025
Jetbrains
Youtrack
risk 0.57cvss 8.7epss 0.00
In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content
CVE-2021-25765HigFeb 3, 2021
Jetbrains
Youtrack
risk 0.57cvss 8.8epss 0.01
In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.
CVE-2020-15817HigAug 8, 2020
Jetbrains
Youtrack
risk 0.57cvss 8.8epss 0.02
In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.
CVE-2019-15040HigOct 2, 2019
Jetbrains
Youtrack
risk 0.57cvss 8.8epss 0.01
JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page.
CVE-2019-12851HigJul 3, 2019
Jetbrains
Youtrack
risk 0.57cvss 8.8epss 0.01
A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852.
CVE-2026-86492HigSep 7, 2026
Jetbrains
Youtrack
risk 0.55cvss 8.5epss 0.01
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens

Page 1 of 8