In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible

In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings

In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export

In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission

In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses

In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages

In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a project

In JetBrains YouTrack before 2023.3.22268 authorization check for inline comments inside thread replies was missed

In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions

In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions

In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed

JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank

In JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limit

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads

In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible

In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks

Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content

In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects

In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations

In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates

In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host

In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators