CVE-2026-49386

In JetBrains YouTrack before versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, an authentication bypass via direct database access was possible, leading to administrative access.

In JetBrains YouTrack before 2026.2.17917, unauthorized project transfer between organizations was possible.

In JetBrains YouTrack before 2026.1.13901 and 2026.2.17950, a DoS attack was possible via crafted type parameters.

In JetBrains YouTrack before 2026.1.13903 and 2026.2.17950, an authenticated user could read restricted articles from other projects via the draft creation endpoint.

In JetBrains YouTrack before 2026.2.18068, stored XSS via the fenced code-block language label was possible.

In JetBrains YouTrack before 2026.2.18177, a Denial of Service (DoS) attack was possible via a decompression bomb in the import endpoint.

In JetBrains YouTrack before 2026.2.18112, an authenticated user could enumerate accounts via the users search endpoint.

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, and 2026.2.18095, missing authorization allowed an authenticated user to delete arbitrary entities via the mailbox endpoint.

In JetBrains YouTrack before version 2026.2.17394, a stored XSS vulnerability was discovered via article titles in digest emails. An attacker can inject malicious JavaScript code into an article title, which will be executed in the recipient's browser when viewing the email.

In JetBrains YouTrack before version 2026.2.17012, a cSS injection vulnerability was discovered via Mermaid diagram rendering. An attacker could exploit this flaw to modify page appearance or potentially steal data.