In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation

In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible

In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues

JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page

A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR

In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint

In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows

In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration

In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues

In JetBrains YouTrack before 2025.2.86069, 2024.3.85077, 2025.1.86199 email spoofing via an administrative API was possible

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action

In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure

In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form

In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API

In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality

In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site

In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation

In JetBrains YouTrack before 2023.1.10518 a DoS attack was possible via Helpdesk forms

In JetBrains YouTrack before 2021.2.16363, an insecure PRNG was used

In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used

In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible

In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly

In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments

In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure via the REST API

JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component

JetBrains YouTrack before 2020.1.659 was vulnerable to DoS that could be caused by attaching a malformed TIFF file to an issue

In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms

In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links

In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates