CVE Catalog
CVE-2026-75044
HighCVSS 8.1Summary
In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, and 2026.2.18095, missing authorization allowed an authenticated user to delete arbitrary entities via the mailbox endpoint.
Risk Assessment
An authenticated user could delete arbitrary entities, potentially leading to data loss or system disruption.
Recommendation
Update YouTrack to one of the specified versions or later.
Original NVD description (English source)
In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint