In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature

In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution

In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address

In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to…

In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack

In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox

JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates

JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection

In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution

An SSRF attack was possible on a JetBrains YouTrack server

Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack

An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack

A query injection was possible in JetBrains YouTrack

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature

In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient

In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation

In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible

In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues

JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page

A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR

In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint

In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows

In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration

In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues

In JetBrains YouTrack before 2025.2.86069, 2024.3.85077, 2025.1.86199 email spoofing via an administrative API was possible

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action

In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure

In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form

In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API

In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality

In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site

In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation

In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms

In JetBrains YouTrack before 2021.2.16363, an insecure PRNG was used

In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used

In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible

In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly

In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments

In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure via the REST API

JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component

JetBrains YouTrack before 2020.1.659 was vulnerable to DoS that could be caused by attaching a malformed TIFF file to an issue