CVE-2026-86486
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank.
Risk Assessment
The risk is that an attacker can send fake VCS webhooks without knowing the secret, potentially leading to unauthorized changes in repositories or other actions.
Recommendation
It is recommended to update YouTrack to version 2026.2.18634 or later, which includes a fix enforcing secret validation, and to configure non-empty secrets for webhooks.
Other vulnerabilities in JetBrains YouTrack
See all- CVE-2026-86478Critical
In JetBrains YouTrack before 2025.3.161254 and 2026.1.14042, improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address.
- CVE-2026-62422Critical
In JetBrains YouTrack before versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, an authentication bypass via direct database access was possible, leading to administrative access.
- CVE-2026-86500Medium
In JetBrains YouTrack before version 2026.1.14047, a missing escalation check allowed a user with project update permissions to grant themselves the Project Admin role.
- CVE-2026-86499Medium
In JetBrains YouTrack before version 2026.1.14047, predefined search fields leaked all group names to any user, regardless of visibility permissions.
- CVE-2026-86497Medium
In JetBrains YouTrack before version 2026.2.18769, changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials.
- CVE-2026-86496Medium
In JetBrains YouTrack before version 2026.2.18769, missing access control on Helpdesk authorized reporters exposed reporter email addresses.
- CVE-2026-86495Medium
In JetBrains YouTrack before version 2026.2.18687, missing permission checks allowed creating knowledge base articles in inaccessible projects.
- CVE-2026-86493Medium
In JetBrains YouTrack before version 2026.2.18634, improper permission checks allowed read-only users to create and modify whiteboard cards.
- CVE-2026-86491Low
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads.
- CVE-2026-86490Medium
In JetBrains YouTrack before version 2026.2.18634, improper permission checks allowed overwriting of bundled apps via the app import endpoint.
Original NVD description (English source)
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank
Vulnerability data from NVD (NIST) · CISA KEV · EPSS