JetBrains YouTrack vulnerabilities

In JetBrains YouTrack before versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, an authentication bypass via direct database access was possible, leading to administrative access.

In JetBrains YouTrack before 2026.2.17917, unauthorized project transfer between organizations was possible.

In JetBrains YouTrack before 2026.1.13901 and 2026.2.17950, a DoS attack was possible via crafted type parameters.

In JetBrains YouTrack before 2026.1.13903 and 2026.2.17950, an authenticated user could read restricted articles from other projects via the draft creation endpoint.

In JetBrains YouTrack before 2026.2.18068, stored XSS via the fenced code-block language label was possible.

In JetBrains YouTrack before 2026.2.18177, a Denial of Service (DoS) attack was possible via a decompression bomb in the import endpoint.

In JetBrains YouTrack before 2026.2.18112, an authenticated user could enumerate accounts via the users search endpoint.

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, and 2026.2.18095, missing authorization allowed an authenticated user to delete arbitrary entities via the mailbox endpoint.

In JetBrains YouTrack before version 2026.2.17394, a stored XSS vulnerability was discovered via article titles in digest emails. An attacker can inject malicious JavaScript code into an article title, which will be executed in the recipient's browser when viewing the email.

In JetBrains YouTrack before version 2026.2.17012, a cSS injection vulnerability was discovered via Mermaid diagram rendering. An attacker could exploit this flaw to modify page appearance or potentially steal data.

In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details.

In JetBrains YouTrack before 2026.2.16593, improper authorization in the app configurations endpoint allowed unauthorized modification of project settings.

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible.

In JetBrains YouTrack before 2026.1.13570, improper access control allowed enumeration of restricted issues and articles on Planning Canvas.

In JetBrains YouTrack before 2026.1.13570, improper access control allowed low-privileged users to modify service accounts.

JetBrains YouTrack before version 2026.1.13162 allows stored XSS in project notification templates.

In JetBrains YouTrack versions before 2023.1.16597, there was an issue with improper captcha validation in Helpdesk forms.

In JetBrains YouTrack versions before 2023.1.10518, a stored XSS vulnerability in the Markdown-rendering engine was present.

In JetBrains YouTrack versions before 2023.1.10518, a DoS attack was possible via Helpdesk forms.