CVE-2026-86497
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In JetBrains YouTrack before version 2026.2.18769, changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials.
Risk Assessment
A project administrator could steal mailbox credentials, potentially leading to unauthorized access to sensitive emails and further security breaches.
Recommendation
Update YouTrack to version 2026.2.18769 or later to enforce re-authentication when changing the mailbox host.
Other vulnerabilities in JetBrains YouTrack
See all- CVE-2026-103497Medium
In JetBrains YouTrack before 2026.2.19422, SSRF was possible via the GitHub VCS integration.
- CVE-2026-103496Medium
In JetBrains YouTrack before 2026.2.19422, iDOR in inbox threads allowed reading other users' notifications.
- CVE-2026-103495Medium
In JetBrains YouTrack before 2026.2.19422, missing authorisation allowed reloading of translation catalogs.
- CVE-2026-103493High
In JetBrains YouTrack before 2026.2.19422, stored XSS via Mermaid and LaTeX content was possible. The vulnerability allows execution of arbitrary script in the user's browser.
- CVE-2026-103492Medium
In JetBrains YouTrack before 2026.2.19422, DoS attack was possible via crafted PSD attachments.
- CVE-2026-103491Medium
In JetBrains YouTrack before 2026.2.19422, iDOR in the issue activities API allowed reading restricted issues.
- CVE-2026-86478Critical
In JetBrains YouTrack before 2025.3.161254 and 2026.1.14042, improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address.
- CVE-2026-62422Critical
In JetBrains YouTrack before versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, an authentication bypass via direct database access was possible, leading to administrative access.
- CVE-2026-111092Medium
In JetBrains YouTrack before 2026.2.19575, 2026.3.16075, 2026.3.16397, and 2026.3.16402, mail rules allowed a project admin to execute cross-project issue commands. This violates the isolation of permissions between projects.
- CVE-2026-103494Medium
In JetBrains YouTrack before 2026.2.19422, privilege escalation was possible via user group membership changes.
Original NVD description (English source)
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials
Vulnerability data from NVD (NIST) · CISA KEV · EPSS