Youtrack
by Jetbrains
CVEs (123)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-62422 | Cri | 0.65 | 10.0 | 0.00 | Jul 14, 2026 | In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible | ||
| CVE-2022-24442 | Cri | 0.64 | 9.8 | 0.04 | Feb 25, 2022 | JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. | ||
| CVE-2021-43185 | Cri | 0.64 | 9.8 | 0.02 | Nov 9, 2021 | JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. | ||
| CVE-2021-25770 | Cri | 0.64 | 9.8 | 0.03 | Feb 3, 2021 | In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution. | ||
| CVE-2019-12852 | Cri | 0.64 | 9.8 | 0.02 | Jul 3, 2019 | An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168. | ||
| CVE-2019-12867 | Cri | 0.64 | 9.8 | 0.02 | Jul 3, 2019 | Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168. | ||
| CVE-2019-12866 | Cri | 0.64 | 9.8 | 0.02 | Jul 3, 2019 | An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168. | ||
| CVE-2019-12850 | Cri | 0.64 | 9.8 | 0.02 | Jul 3, 2019 | A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168. | ||
| CVE-2021-37549 | Cri | 0.59 | 9.1 | 0.01 | Aug 6, 2021 | In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. | ||
| CVE-2026-49368 | Hig | 0.57 | 8.7 | 0.00 | May 29, 2026 | In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible | ||
| CVE-2026-28193 | Hig | 0.57 | 8.8 | 0.00 | Feb 25, 2026 | In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint | ||
| CVE-2025-57731 | Hig | 0.57 | 8.7 | 0.00 | Aug 20, 2025 | In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content | ||
| CVE-2021-25765 | Hig | 0.57 | 8.8 | 0.01 | Feb 3, 2021 | In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible. | ||
| CVE-2020-15817 | Hig | 0.57 | 8.8 | 0.02 | Aug 8, 2020 | In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues. | ||
| CVE-2019-15040 | Hig | 0.57 | 8.8 | 0.01 | Oct 2, 2019 | JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page. | ||
| CVE-2019-12851 | Hig | 0.57 | 8.8 | 0.01 | Jul 3, 2019 | A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852. | ||
| CVE-2025-64685 | Hig | 0.53 | 8.1 | 0.00 | Nov 10, 2025 | In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure | ||
| CVE-2024-49579 | Hig | 0.53 | 8.1 | 0.00 | Oct 17, 2024 | In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests | ||
| CVE-2024-54154 | Hig | 0.52 | 8.0 | 0.01 | Dec 4, 2024 | In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox | ||
| CVE-2025-48391 | Hig | 0.50 | 7.7 | 0.00 | May 20, 2025 | In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API |
- risk 0.65cvss 10.0epss 0.00
In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
- risk 0.64cvss 9.8epss 0.04
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
- risk 0.64cvss 9.8epss 0.02
JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection.
- risk 0.64cvss 9.8epss 0.03
In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution.
- risk 0.64cvss 9.8epss 0.02
An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49168.
- risk 0.64cvss 9.8epss 0.02
Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 2018.4.49168.
- risk 0.64cvss 9.8epss 0.02
An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168.
- risk 0.64cvss 9.8epss 0.02
A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168.
- risk 0.59cvss 9.1epss 0.01
In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient.
- risk 0.57cvss 8.7epss 0.00
In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible
- risk 0.57cvss 8.8epss 0.00
In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint
- risk 0.57cvss 8.7epss 0.00
In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content
- risk 0.57cvss 8.8epss 0.01
In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.
- risk 0.57cvss 8.8epss 0.02
In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.
- risk 0.57cvss 8.8epss 0.01
JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page.
- risk 0.57cvss 8.8epss 0.01
A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852.
- risk 0.53cvss 8.1epss 0.00
In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure
- risk 0.53cvss 8.1epss 0.00
In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests
- risk 0.52cvss 8.0epss 0.01
In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox
- risk 0.50cvss 7.7epss 0.00
In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API
Page 1 of 7