CVE-2026-123335
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, and 2025.3.169041, missing authorization allowed attaching tags to any issue via the tag issues collection.
Risk Assessment
A user without proper permissions can modify issue metadata, potentially corrupting work organization and data integrity.
Recommendation
Upgrade YouTrack to version 2026.2.19562 or later and review permissions for issue tagging operations.
Other vulnerabilities in JetBrains YouTrack
See all- CVE-2026-103497Medium
In JetBrains YouTrack before 2026.2.19422, SSRF was possible via the GitHub VCS integration.
- CVE-2026-103496Medium
In JetBrains YouTrack before 2026.2.19422, iDOR in inbox threads allowed reading other users' notifications.
- CVE-2026-103495Medium
In JetBrains YouTrack before 2026.2.19422, missing authorisation allowed reloading of translation catalogs.
- CVE-2026-103493High
In JetBrains YouTrack before 2026.2.19422, stored XSS via Mermaid and LaTeX content was possible. The vulnerability allows execution of arbitrary script in the user's browser.
- CVE-2026-103492Medium
In JetBrains YouTrack before 2026.2.19422, DoS attack was possible via crafted PSD attachments.
- CVE-2026-103491Medium
In JetBrains YouTrack before 2026.2.19422, iDOR in the issue activities API allowed reading restricted issues.
- CVE-2026-86478Critical
In JetBrains YouTrack before 2025.3.161254 and 2026.1.14042, improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address.
- CVE-2026-62422Critical
In JetBrains YouTrack before versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, an authentication bypass via direct database access was possible, leading to administrative access.
- CVE-2026-123850Low
In JetBrains YouTrack before 2026.2.19422, CSS injection was possible in Mermaid diagrams via configuration directives.
- CVE-2026-123337Low
In JetBrains YouTrack before 2026.2.19656, users without update permission could change issue visibility.
Original NVD description (English source)
In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection
Vulnerability data from NVD (NIST) · CISA KEV · EPSS