CVE-2026-86499
MediumCVSS 4.3Summary
In JetBrains YouTrack before version 2026.1.14047, predefined search fields leaked all group names to any user, regardless of visibility permissions.
Risk Assessment
A confidentiality breach could expose sensitive information about user groups, potentially facilitating social engineering or further privilege escalation.
Recommendation
Update YouTrack to version 2026.1.14047 or later to prevent the leakage of group names.
Other vulnerabilities in JetBrains YouTrack
See all- CVE-2026-86500Medium
In JetBrains YouTrack before version 2026.1.14047, a missing escalation check allowed a user with project update permissions to grant themselves the Project Admin role.
- CVE-2026-86497Medium
In JetBrains YouTrack before version 2026.2.18769, changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials.
- CVE-2026-86496Medium
In JetBrains YouTrack before version 2026.2.18769, missing access control on Helpdesk authorized reporters exposed reporter email addresses.
- CVE-2026-86495Medium
In JetBrains YouTrack before version 2026.2.18687, missing permission checks allowed creating knowledge base articles in inaccessible projects.
- CVE-2026-86493Medium
In JetBrains YouTrack before version 2026.2.18634, improper permission checks allowed read-only users to create and modify whiteboard cards.
- CVE-2026-86491Low
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads.
- CVE-2026-86490Medium
In JetBrains YouTrack before version 2026.2.18634, improper permission checks allowed overwriting of bundled apps via the app import endpoint.
- CVE-2026-86489Medium
In JetBrains YouTrack before version 2026.2.18634, an IDOR in the user profile API disclosed private issues and starred folders across organizations.
- CVE-2026-86488Medium
In JetBrains YouTrack before version 2026.2.18634, an IDOR via the watchRules and issueListConfig endpoints exposed private saved searches.
- CVE-2026-86487Low
In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content.
Original NVD description (English source)
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission