CVE-2026-86500
MediumCVSS 5.5Summary
In JetBrains YouTrack before version 2026.1.14047, a missing escalation check allowed a user with project update permissions to grant themselves the Project Admin role.
Risk Assessment
A user with limited permissions could gain full control over a project, potentially leading to unauthorized changes and data integrity breaches.
Recommendation
Update YouTrack to version 2026.1.14047 or later to remediate this vulnerability.
Other vulnerabilities in JetBrains YouTrack
See all- CVE-2026-86499Medium
In JetBrains YouTrack before version 2026.1.14047, predefined search fields leaked all group names to any user, regardless of visibility permissions.
- CVE-2026-86497Medium
In JetBrains YouTrack before version 2026.2.18769, changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials.
- CVE-2026-86496Medium
In JetBrains YouTrack before version 2026.2.18769, missing access control on Helpdesk authorized reporters exposed reporter email addresses.
- CVE-2026-86495Medium
In JetBrains YouTrack before version 2026.2.18687, missing permission checks allowed creating knowledge base articles in inaccessible projects.
- CVE-2026-86493Medium
In JetBrains YouTrack before version 2026.2.18634, improper permission checks allowed read-only users to create and modify whiteboard cards.
- CVE-2026-86491Low
In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads.
- CVE-2026-86490Medium
In JetBrains YouTrack before version 2026.2.18634, improper permission checks allowed overwriting of bundled apps via the app import endpoint.
- CVE-2026-86489Medium
In JetBrains YouTrack before version 2026.2.18634, an IDOR in the user profile API disclosed private issues and starred folders across organizations.
- CVE-2026-86488Medium
In JetBrains YouTrack before version 2026.2.18634, an IDOR via the watchRules and issueListConfig endpoints exposed private saved searches.
- CVE-2026-86487Low
In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content.
Original NVD description (English source)
In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin