CVE-2026-75045
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
Risk Assessment
An unauthenticated attacker could access database backups, potentially leading to sensitive data leakage.
Recommendation
Upgrade YouTrack to version 2025.3.156085, 2026.1.13913, or 2026.2.18112 (or later) depending on your release line.
Other vulnerabilities in YouTrack
See all- CVE-2026-86498High
In JetBrains YouTrack before 2025.3.160480 and 2026.1.14047, PUT requests on link sub-resources allowed modification of linked entities without update permission.
- CVE-2026-86494High
In JetBrains YouTrack before 2026.2.18634, cloning a whiteboard allowed unauthorized changes to links on inaccessible issues.
- CVE-2026-86492High
In JetBrains YouTrack before 2026.2.18634, a shared token cache allowed cross-tenant theft of GitHub App installation tokens.
- CVE-2026-49370Low
In JetBrains YouTrack before version 2026.1.13162, an information disclosure vulnerability was possible on fetchApp requests, allowing attackers to access unauthorized data.
- CVE-2026-49369Medium
A vulnerability was found in JetBrains YouTrack before version 2026.1.13162 that allows information disclosure on the Users and Groups pages.
Original NVD description (English source)
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
Vulnerability data from NVD (NIST) · CISA KEV · EPSS