CVE-2026-86500
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In JetBrains YouTrack before version 2026.1.14047, a missing escalation check allowed a user with project update permissions to grant themselves the Project Admin role.
Risk Assessment
A user with limited permissions could gain full control over a project, potentially leading to unauthorized changes and data integrity breaches.
Recommendation
Update YouTrack to version 2026.1.14047 or later to remediate this vulnerability.
Other vulnerabilities in JetBrains YouTrack
See all- CVE-2026-103497Medium
In JetBrains YouTrack before 2026.2.19422, SSRF was possible via the GitHub VCS integration.
- CVE-2026-103496Medium
In JetBrains YouTrack before 2026.2.19422, iDOR in inbox threads allowed reading other users' notifications.
- CVE-2026-103495Medium
In JetBrains YouTrack before 2026.2.19422, missing authorisation allowed reloading of translation catalogs.
- CVE-2026-103493High
In JetBrains YouTrack before 2026.2.19422, stored XSS via Mermaid and LaTeX content was possible. The vulnerability allows execution of arbitrary script in the user's browser.
- CVE-2026-103492Medium
In JetBrains YouTrack before 2026.2.19422, DoS attack was possible via crafted PSD attachments.
- CVE-2026-103491Medium
In JetBrains YouTrack before 2026.2.19422, iDOR in the issue activities API allowed reading restricted issues.
- CVE-2026-86478Critical
In JetBrains YouTrack before 2025.3.161254 and 2026.1.14042, improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address.
- CVE-2026-62422Critical
In JetBrains YouTrack before versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, an authentication bypass via direct database access was possible, leading to administrative access.
- CVE-2026-111092Medium
In JetBrains YouTrack before 2026.2.19575, 2026.3.16075, 2026.3.16397, and 2026.3.16402, mail rules allowed a project admin to execute cross-project issue commands. This violates the isolation of permissions between projects.
- CVE-2026-103494Medium
In JetBrains YouTrack before 2026.2.19422, privilege escalation was possible via user group membership changes.
Original NVD description (English source)
In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin
Vulnerability data from NVD (NIST) · CISA KEV · EPSS