In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes

In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands

In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments

In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials

In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template

In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards

In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint

In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations

In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint

In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles on Planning Canvas

In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts

In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs

In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector

In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack

In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter

In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissions

In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articles

In JetBrains YouTrack versions before 2020.3.4313, 2020.2.11008, 2020.1.11011, 2019.1.65514, 2019.2.65515, and 2019.3.65516, an attacker can retrieve an issue description without…

In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible

In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass security restrictions

In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possible

In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API

In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests

In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS

JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description

In JetBrains YouTrack through 2019.2.56594, stored XSS was found on the issue page

JetBrains YouTrack versions before 2019.1.52545 allowed unbounded URL whitelisting because of Inclusion of Functionality from an Untrusted Control Sphere

JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser

JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles

In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters

In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin

In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs

In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications

In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible

In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission

In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible

In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible

In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content

In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements

In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag

In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule